Deep Malware Cleaner is a lightweight deep malware scanner built for WordPress. It performs a thorough deep cleanup scan of your wp-content directory, verifies your WordPress core files against the official checksums, detects backdoors, finds injected site scripts, flags redirect hacks, and scans your database for hidden payloads — all from your WordPress admin dashboard, with no external service, no subscription, and no scan data ever leaving your server.

Whether you’re dealing with a live attack, a hidden backdoor, or a redirect hack silently sending visitors to malicious sites, Deep Malware Cleaner gives you the tools to scan, alert, and act — fast.

Finding the infected file is only half the job. Deep Malware Cleaner also surfaces the things attackers leave behind so a cleaned site stays clean: the second administrator account, the scheduled event that re-downloads the payload, and the uploads directory that will happily execute the next webshell.

Core Capabilities

Deep Cleanup Scan
Walks your entire wp-content directory, inspecting PHP files plus the client-side formats most often used to deliver malware — JavaScript, HTML, SVG, and .htaccess — for known signatures, obfuscated code, and injected payloads. Results are sorted by severity so the worst threats surface first.

Pre-Install Upload Guard
Scans plugins, themes, and risky media uploads (.php, .svg, .html, .js, .htaccess) in their temporary directory before WordPress moves them into place. If malware is detected the install or upload is aborted and an error is shown — stopping a compromised package before it ever touches your site. Can be toggled in Settings.

Database Scanner
Inspects the most-targeted database tables — options, posts, comments, and post meta — for injected scripts, hidden iframes, and encoded payloads, using keyset pagination and a time budget so it stays safe on a live site.

Core Integrity Check
Hashes every file of your WordPress installation and compares it against the official checksums published by WordPress.org, so a patched wp-login.php or a webshell hidden inside wp-includes cannot pass as a core file. Findings are split into modified, unknown, and missing.

Recently Modified Files
Lists every PHP file changed in the last 1–30 days, newest first. After a break-in the attacker’s files are usually the newest ones on the site, which makes this the fastest way to spot an intrusion the signature rules have not seen before.

Admin User Audit
Reviews every administrator account for the patterns that give away an attacker-created login — added recently, an email on an unrelated domain, no display name, or a machine-generated username. Read-only: no account is ever changed or removed for you.

Cron Job Audit
Lists every WordPress scheduled event and flags the ones no active code listens for, or whose hook name looks obfuscated. If a site keeps getting reinfected after a clean-up, a hidden cron event is the usual reason.

Uploads Directory Protection
Blocks PHP execution in wp-content/uploads with one click. Nothing you upload to WordPress is ever a PHP file, so denying PHP outright turns a webshell dropped through a vulnerable plugin into a file the attacker cannot run. Reversible at any time.

Backdoor Fixer
Detects PHP backdoors uploaded through vulnerable plugins or themes — including webshells, remote-execution scripts, and hidden PHP files inside the uploads folder where no PHP should ever exist.

Site Script Cleaner
Identifies injected JavaScript and malicious <script> tags, hidden iframes, and obfuscated code blocks embedded in your theme or plugin files.

Redirect Hack Fix
Flags the PHP patterns most commonly responsible for redirect hacks — including header() injection, variable-based shell execution, and compressed payload backdoors used to silently redirect visitors to attack sites.

Threat Triage
Review every finding on the scan results screen with its full path, threat type, and severity, and dismiss anything you’ve confirmed is a false positive with one click. One-click Quarantine and Restore are available in Deep Malware Cleaner Pro.

Login Protection
Hardens your WordPress login against brute-force attacks and unauthorized access attempts — an essential layer of website protection alongside active scanning.

Instant Alerts
Get notified the moment a scan finds a threat. Real-time alerts keep you informed so you can respond before an attack escalates.

What the Scanner Detects

eval(base64_decode(…)) — the most widespread PHP malware obfuscation and attack vector.
eval(gzinflate(…)) / eval(gzuncompress(…)) — compressed-payload backdoors.
eval(str_rot13(…)) — rotation-cipher obfuscated malware.
Shell execution with dynamic arguments — shell_exec, passthru, proc_open, popen, and system called with a variable, a classic attack pattern for remote code execution.
Hidden iframes — <iframe> elements injected with display:none used to load malicious content invisibly.
Long base64 strings — unusually large base64 blobs embedded in PHP, a common technique for hiding large attack payloads.
Obfuscated JavaScript — eval(atob(...)) payload pairs and javascript-obfuscator (_0x hex identifier) fingerprints in JS, HTML, and SVG files.
PHP files inside the uploads directory — any .php file in wp-content/uploads/ is flagged High severity; legitimate uploads are never PHP files.

Key Features

Lightweight deep malware scanner — reads only the first 64 KB of each file and runs under a strict time budget, so it stays fast and safe on shared hosting.
On-demand and scheduled scans — run manually with Start Scan, plus an optional automatic daily scan with email alerts.
Deep Cleaner dashboard — at-a-glance stats: threats found, files scanned, time since last scan.
Website Security & Website Protection — comprehensive coverage against the most common WordPress attack types.
Troubleshoot mode — detailed per-file reporting to help you understand exactly what was found and why it was flagged.
Secure login hardening included.
All scan history stored in your own database — nothing leaves your server.
No account and no API key, ever. The only outbound request the plugin makes is to WordPress.org for the official core checksums, and only when you run the Core Integrity check.
Translatable — all strings are internationalised and ready for translation via WordPress.org.

Deep Malware Cleaner Pro

Detection is free and always will be. Deep Malware Cleaner Pro adds the one-click remediation engine on top:

Quarantine — moves an infected file to a protected directory that can never be executed or downloaded over HTTP, warning you first if the file belongs to an active plugin or theme.
Restore — puts a quarantined file back exactly where it was, so a false positive is never a lost file.

Learn more about Deep Malware Cleaner Pro

Who Is This For?

Site owners who received a “this site may be hacked” alert from Google.
Developers who need to troubleshoot a suspected redirect hack or injected script.
Agencies that manage multiple WordPress sites and need a fast, lightweight scanner with no SaaS dependency.
Anyone who wants ongoing website security and website protection without a monthly fee.

Privacy

No scan data ever leaves your site. Results, alert history, and audit findings live only in your own WordPress database, and are removed when you uninstall the plugin if that option is enabled in Settings. There is no account, no API key, and no third-party service involved.

The plugin makes exactly one external request, and only when you click Run Integrity Check on the Core Integrity screen: it fetches the official file checksums for your WordPress release from https://api.wordpress.org/core/checksums/1.0/ — the same public endpoint WordPress core itself uses. The request carries only your WordPress version and site locale; no file contents, scan results, or site data are transmitted. Responses are cached for 12 hours. If you never open that screen, the plugin makes no outbound requests at all.

WordPress.org’s privacy policy applies to that request: https://wordpress.org/about/privacy/