=== Malcure Malware Removal, Monitor and Security Hardening ===
Contributors: malcure,cybermalcure
Tags: malware scanner, antivirus, firewall, vulnerability scanner, security
Requires at least: 3.7.4
Tested up to: 6.9
Requires PHP: 5.6
Stable tag: 19.5
License: MIT
License URI: https://opensource.org/licenses/MIT

High Accuracy malware scanner & WAF. Clean hacked sites easily.

== Description ==

**The Only Security Plugin You Need: Detection, Protection, and Reporting.**

When your site is hacked, you don't need "maybe". You need "definitely". Malcure Malware Scanner is precision-engineered to detect over 50,000+ threats with **Zero False Positives**.

Trusted by 10,000+ site owners and security professionals, Malcure doesn't just "scan" — it investigates. From hidden backdoors in your database to obfuscated code in your images, we find what others miss.

= Powered by Malcure API: Real-Time Threat Intelligence =
Hackers don't sleep, and neither do we. Malcure connects to our real-time API to fetch the latest threat definitions.

This plugin relies on the Malcure API to provide real-time threat intelligence and checksum verification.
-   **Data Transmission:** To perform scans, the plugin sends file checksums and your site's domain to Malcure servers. No sensitive user data or file contents are transmitted unless you explicitly use the "Inspect File" feature.
-   **Terms & Privacy:** Use of the API is subject to our [Terms of Use](https://www.malcure.com/?p=1720&utm_source=readme&utm_medium=web&utm_campaign=wpmr) and [Privacy Policy](https://malcure.com/?p=3&utm_source=readme&utm_medium=web&utm_campaign=wpmr).

-   **Zero-Day Alerts:** Our API analyzes new threats in real-time, ensuring the site is scanned against the latest vulnerabilities.
-   **Smart Checksums:** We verify your core files against the official WordPress repository using our API, ensuring absolute integrity.
-   **Lightweight:** By offloading heavy analysis to our API, we keep your server fast and responsive.

= Why Malcure? =

-   **Precision, Not Noise:** Our advanced heuristic engine is tuned to distinguish between legitimate code and malicious payloads. No more heart attacks over false alarms.
-   **Surgical Cleanup:** Don't nuke your site. Malcure identifies the exact infection so you can surgically remove the malicious code while keeping your website fully functional.
-   **Performance First:** Built to be lightweight. We scan rigorously without bringing your server to its knees.

= Who This Plugin Is For =

-   **Site owners** who want clear, actionable results (what was flagged and where).
-   **Agencies & developers** who need fast triage across multiple sites.
-   **WooCommerce / membership / lead-gen sites** where downtime and SEO damage are expensive.
-   **Anyone** who wants a scanner that cuts through the noise to focus on *signal*—real threats with practical remediation paths.

= How It Works (Scan → Review → Clean → Monitor) =

1.  **Scan**
    -   Go to **Malcure Scanner** in your WordPress admin.
    -   Run a scan to check your files and database for malware, backdoors, suspicious code, and integrity issues.

2.  **Review**
    -   Malcure reports findings with clear locations (file paths / database records) so you can verify what changed and why it was flagged.
    -   Use the results to decide what should be repaired, deleted, or kept (for example, legitimate custom code).

3.  **Clean & Recover**
    -   The free edition helps you identify issues and understand what needs fixing.
    -   The Advanced Edition adds cleanup tools (Inspect / Repair / Delete for infected files) and workflow features like custom whitelisting.
4.  **Monitor**
    -   Set up scheduled scans to keep your site continuously monitored.
    -   Get alerts for new infections or integrity issues.

= Free vs Advanced (Feature Comparison) =

Below is a practical feature comparison to help you choose the right edition.

| Feature | Free | Advanced |
| --- | --- | --- |
| Deep malware scan (files + database) | Yes | Yes |
| Checksum verification (WordPress core integrity) | Yes | Yes |
| Vulnerability scanner | Yes | Yes |
| Firewall (WAF) & hardening | Yes | Yes |
| Incident response toolkit (sessions, salts, etc.) | Yes | Yes |
| Event logging | Yes | Yes |
| Google Search Console integration | Yes | Yes |
| 1-click cleanup actions (Inspect / Repair / Delete infected files) | No | Yes |
| Custom whitelisting (files/folders) | No | Yes |
| WP-CLI integration | No | Yes |
| High-priority support | No | Yes |
| Real-time definition updates | No | Yes |


[youtube https://www.youtube.com/watch?v=EbSbxiTOc8k]

= Core Features (Free Forever) =

-   **Deep Malware Scan:** Scans core files, themes, plugins, images, and your entire database for viruses, trojans, backdoors, and [malicious redirects](https://malcure.com/?p=60&utm_source=readme&utm_medium=web&utm_campaign=wpmr).
    -   **Files:** Scans core files, themes, plugins, images, and uploads for backdoors, shells (C99, R57), and obfuscated code.
    -   **Database:** Scans database tables for malicious injections and spam links.
    -   **SEO Spam Detection:** Specifically checks page titles and database records for "Japanese Keyword Hack", "Pharma Hack" and other SEO spam symptoms.
    -   **Vulnerability Scanner:** Checks your installed plugins and themes against our real-time database of known security vulnerabilities.
    -   **Intelligent Checksum Verification:** Automatically verifies your files against the official WordPress repository. If a core file has been tampered with, we know instantly.
    -   **Uncompromising Detection:** Detects C99, R57, RootShell, Crystal Shell, Matamu, and thousands of other known and unknown variants.
-   **Firewall (WAF) & Hardening:**
    -   **Block Path Traversal:** Stops attackers from accessing sensitive system files.
    -   **Block PHP Uploads:** Prevents malicious scripts from being uploaded to your site.
    -   **Stop User Enumeration:** Blocks bots from fishing for your username.
    -   **REST API Protection:** Prevents user data leakage via the WP REST API.
    -   **[Security Hardening](https://malcure.com/?p=1622&utm_source=readme&utm_medium=web&utm_campaign=wpmr):** Learn more about securing your WordPress site.
-   **Automated Background Scans & Monitoring:**
    -   **Set it and forget it:** Malcure runs silently in the background. Schedule daily, weekly, or monthly scans associated with the new 'Malware Monitor' feature.
    -   **Stay Ahead:** Automatically catch new infections before they spread or damage your SEO rankings.
-   **Incident Response Toolkit:**
    -   **Nuke User Sessions:** Instantly force-logout every user on the site to kick out intruders.
    -   **Salt Shuffler:** One-click rotation of [WordPress security keys (salts)](https://malcure.com/?p=5230&utm_source=readme&utm_medium=web&utm_campaign=wpmr) to invalidate all browser cookies.
    -   **Comprehensive Event Logging:** Track every security event. Know exactly *when* and *how* a breach might have occurred with our 100-day event log.
-   **Google Search Console Integration:** Connect directly to Google to fetch security warnings and blacklist status in real-time.
-   **Real-Time API Updates:** Connects to the Malcure Cloud to detect the latest threats and vulnerabilities.

= Upgrade to Advanced Edition =

For mission-critical websites that demand comprehensive protection and recovery tools.

-   **1-Click Fixes:** Inspect, Delete or Repair infected files instantly with a single clicks.
-   **On-Demand Background Scanning:** Run deep scans that continue working even if you close your browser. Perfect for humongous sites.
-   **Real-Time Definition Updates:** Stay protected against the very latest threats discovered by our security labs.
-   **WP-CLI Integration:** Automate scans and cleanups via command line — a developer's dream. See our [WP-CLI Cheatsheet](https://malcure.com/?p=9102&utm_source=readme&utm_medium=web&utm_campaign=wpmr).
-   **Custom Whitelisting:** Full control to whitelist specific files or folders.
-   **High-Priority Support:** Direct access to our security analysts.

[**Get Malcure Advanced Edition**](https://malcure.com/?p=116&utm_source=readme&utm_medium=web&utm_campaign=wpmr)

= What Our Users Say =

> "Best by far, better than Wordfence and other giants... I spent hours trying to find a plugin like this... Simple and effective." — [@dalingzaf](https://wordpress.org/support/topic/best-by-far-better-than-wordfence-and-other-giants/)

> "The ONLY plugin that scans files in real time. I am a web developer and have tried many malware removal plugins, including popular ones like Wordfence and Sucuri. However, none of them detected some unusual files that were actually malware causing regular attacks." — [@devzeeshanx](https://wordpress.org/support/topic/the-only-plugin-that-scans-files-in-real-time-2/)

> "Accurately shows which Database table row is infected and it helps resolve the hacking attempt instantly. Saves a lot of time for the developers." — [@s3630](https://wordpress.org/support/topic/best-malware-removal-plugin-in-just-few-minutes/)

> "It’s not just a “teaser”. This plugin really found the malware, and removed it. Really for free." — [@halucska](https://wordpress.org/support/topic/its-not-just-a-teaser/)

= Additional Resources for Malware Removal =

Follow these expert guides to remove malware, recover lost traffic, and restore your online reputation:

-   [A step by step guide to remove the malware](https://malcure.com/?p=1540&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [Japanese Keyword Hack: How to Remove SEO Spam](https://malcure.com/?p=13946&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [What is the WordPress Pharma Hack & How to fix it](https://malcure.com/?p=5728&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Fix Google Ads Disapproved for Malicious Software](https://malcure.com/?p=14143&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Prevent WordPress SQL Injection Attacks](https://malcure.com/?p=14477&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [Live Malware Infection Removal & Analysis](https://malcure.com/?p=5265&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Fix “This Site May Harm Your Computer” Warning](https://malcure.com/?p=7207&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [Comprehensive Guide to Removing JavaScript Redirect Malware](https://malcure.com/?p=60&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Fix a Blank WP-Admin Page](https://malcure.com/?p=5699&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [Malcure WP CLI Integration & Cheatsheet](https://malcure.com/?p=9102&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Prevent Brute Force Attacks](https://malcure.com/?p=14375&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)
-   [How to Change WordPress Salt Keys](https://malcure.com/?p=5230&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)

= Expert Malware Removal Service =

In over your head? Our security analysts are on standby. We offer a complete **Malware Removal Service** that includes:
-   **100% Removal Guarantee:** We guarantee to remove all malware from your website.
-   **Same Day Service:** Fast turnaround time to get your business back online.
-   **DeepScan™ Technology:** Scans backups, archives, images, and hidden files where malware hides.
-   **Manual Inspection:** Our experts manually inspect critical files (htaccess, wp-config, index.php) and your database.
-   **Blacklist Removal:** We handle the removal of your site from blacklists like Google, Norton, McAfee, etc.
-   **Security Hardening:** We identify the root cause and patch vulnerabilities to prevent future infections.
-   **15-Day Cover:** Security analysts available 24/7/365 to ensure your site stays clean.

[**Book Expert Malware Removal**](https://malcure.com/?p=107&utm_source=readme&utm_medium=web&utm_campaign=wpmr)

== Installation ==

1.  Upload the `wp-malware-removal` folder to the `/wp-content/plugins/` directory.
2.  Activate the plugin through the 'Plugins' menu in WordPress.
3.  Go to the Malcure Scanner menu to start your first scan.

== Frequently Asked Questions ==

= My site is hacked. What should I do? =

Option 1: If you are tech-savvy, you can use this plugin, analyse the results and remove malware yourself.

Option 2: You can file a service request with us. Don't delay—malware spreads fast! Our service includes malware cleanup and blacklist removal by our security analysts. [Please click here to file a support request](https://malcure.com/?p=107&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

= How to remove malware from website? =

Please see [How to use Malcure Malware Scanner Plugin for website Malware Removal](https://malcure.com/?p=9094&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr) and [10-Step Guide to Removing Malware from Your Site](https://malcure.com/?p=1&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr). Follow these steps for a permanent fix to secure your site and recover lost traffic.

= Why should I use Malcure Malware Scanner? =

Several reasons:

a) Malcure Malware Scanner scans all files, even images and archives so deep hidden malware is also easily detected.

b) Checks all core, theme and plugin files for checksums.

c) Scans over 50,000+ known malware including variants like C99, R57, RootShell, dolohan, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx and many more.

d) Hybrid scan ensures unknown threats are also identified.

In short, Malcure Malware Scanner detects everything. It's fast, simple to use and extremely thorough. With improved security, your site remains trustworthy, boosting SEO rankings, user confidence, and conversions.

= What support options are available for Malcure Malware Scanner users? =

Providing excellent support is extremely important to us. You can report the issue at [Malcure forums](https://malcure.com/?p=5677&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr) and our dedicated web-security specialist will ensure that the matter is resolved to your satisfaction.

= What makes Malcure Malware Scanner different from other security plugins? =

Malcure Malware Scanner is a local website scanner with comprehensive file and database scanning capabilities. Malcure Malware Scanner does its job very well. If you have feedback, please do not hesitate to share with us.

Also Malcure Malware Scanner scans every file regardless of whether it's an image, archive etc. Modern malware hides in unsuspicious files and Malcure Malware Scanner makes sure those are not missed. Malcure Malware Scanner is extremely thorough and leaves no aspect of the site to speculation. Try Malcure to experience exceptional thoroughness and speed in removing website malware.

= Will Malcure Malware Scanner impact the performance of my website? =

Malcure Malware Scanner only runs when you want it to. At all other times it sleeps silently. The firewall triggers extremely quickly and is optimized for performance.

= Where can I find the Malcure Terms of Use and Privacy Policy? =

These are available on our website: [Terms of Use](https://www.malcure.com/?p=1720&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr) and [Privacy Policy](https://malcure.com/?p=3&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr)

= Why do I need to register? =
Registration connects your site to the Malcure API enabling real-time threat intelligence. It's free and ensures you get the best protection.

= Does this plugin remove malware automatically? =
The free version detects malware with high precision. The [Advanced Edition](https://malcure.com/?p=116&utm_source=readme&utm_medium=web&utm_campaign=wpmr) offers cleanup features for files.

= Will it slow down my site? =
No. Malcure is designed to be lightweight and runs only when you trigger a scan or schedule one.

= What data is sent to the Malcure API? =
To perform scans, the plugin sends file checksums and your site's domain to Malcure servers. No sensitive user data or file contents are transmitted unless you explicitly use the "Inspect File" feature.

= What's the difference between Free and Advanced? =
Both editions scan files and the database, verify WordPress core integrity, and include firewall/hardening features.

The Advanced Edition adds cleanup workflows (Inspect / Repair / Delete for infected files), WP-CLI integration, custom whitelisting, and high-priority support.

= How should I interpret results like "infected" vs "suspicious"? =
"Infected" generally means the scanner has high confidence the code matches malicious patterns.

"Suspicious" can indicate risky/obfuscated behavior or something that warrants review (for example, heavily minified code or unusual PHP patterns). If you're unsure, use Inspect (Advanced) or [contact support](https://malcure.com/?p=157&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

== Troubleshooting ==

= Some files are detected by Malcure Malware Scanner as "suspicious". What gives? =

Malcure's SmartScan checks each file for malware. However some files aren't pure malware but may contain code that is suspicious and could do nasty things. You should carefully review and analyse them to see if they indeed do anything nasty.

= I can't get Malcure Malware Scanner to work. It hangs / doesn't complete the scan / breaks for some reason. =

If you think that the plugin is broken, [please report it here](https://malcure.com/?p=5677&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

Malcure Malware Scanner (or for that matter other plugins) may break on malware affected / broken websites. [Malcure Advanced Edition](https://malcure.com/?p=116&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr) integrates with WP CLI and allows you to complete the scan from WP CLI.

= My site is infected however Malcure Malware Scanner doesn't detect the infection. =

Malware keeps evolving. If you come across malware that Malcure Malware Scanner is not able to identify, you may [please report it here](https://malcure.com/?p=157&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

= The scan gets stuck midway. What should I do? =

In case of such an event, please file a support request with us and we'll be more than happy to troubleshoot the issue.

Please visit [this page](https://malcure.com/?p=5677&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

= I cleaned my site but it got infected again. What should I do? =

Malware cleanup is a waste of time and effort unless you find the root cause behind the malware infection. How was someone able to infect your website? Have you plugged in that security hole?

Please read [Why Do Websites Get Hacked](https://malcure.com/blog/security/why-do-wordpress-websites-get-hacked/?utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

= Google Safe Browsing site status (or some other scanner) still shows my site as infected. What should I do? =

First make sure you purge your site cache. Second, Google (and other scanners) cache the results for some time. You'll need to force or refresh the scan. You can also file a request with us to [get your site off any blacklists](https://www.malcure.com/?p=107&utm_source=readmefaq&utm_medium=web&utm_campaign=wpmr).

= I found a suspicious file, what now? =
If Malcure flags it, it's likely malicious. You can inspect the file content using our built-in inspector. If you're unsure, consider our [Expert Malware Removal Service](https://malcure.com/?p=107&utm_source=readme&utm_medium=web&utm_campaign=wpmr).

== Screenshots ==

1. Start a malware scan from the Malcure Scanner dashboard.
2. Scan results highlighting affected files and database records.
3. Event Log showing security-relevant site activity (updates and actions).
4. Scan filters to help narrow results by type and severity.
5. File Inspector to review suspicious or infected files (Advanced Edition).
6. Scan Log / activity history to track what ran and when.
7. Hardening settings and firewall rules.
8. Full view of scan findings for deeper investigation.
9. Running scans via WP-CLI (Advanced Edition).
10. Reviewing scan results via WP-CLI (Advanced Edition).

== Changelog ==

= 19.5 =
* New: Clearer admin UI labeling.
* Bugfix: Styles not loading on Scan Scheduler page.
* Stability: Several other stability fixes.

= 19.4 =
* Major Bugfix: Fatal error during auto-upgrade.
* Updated readme.

= 19.3 =
* Major Bugfix: The very initial database record was never scanned.
* Feature: New DB-record inspection + (Advanced Edition) DB-record whitelisting.
* Improvement: Smart Checksum Refresh — Updates only modified components during upgrades for faster performance.
* Major: Checksum system overhaul: more robust payload handling, better core vs non-core validation, and automatic checksum refresh after WP/plugin/theme upgrades.

= 19.2 =
* Feature: Major performance optimization for checksums.
* Feature: Enhanced SaaS API integration with signature verification.
* Feature: Compatibility check for plugin version.
* UX: Improved license validation and error messages.
* UX: Better handling of database vs file infections in UI.

= 19.1 =
* Feature: Introducing enhanced cleanup operations.

= 19.0 =
* Bugfix: Enhanced detection of suspicious empty files in core directories.

== Upgrade Notice ==

= 19.5 =
* New: Clearer admin UI labeling.
* Bugfix: Styles not loading on Scan Scheduler page.
* Stability: Several other stability fixes.

= 19.4 =
* Major Bugfix: Fatal error during auto-upgrade.
* Updated readme.

= 19.3 =
* Major Bugfix: The very initial database record was never scanned.
* Feature: New DB-record inspection + (Advanced Edition) DB-record whitelisting.
* Improvement: Smart Checksum Refresh — Updates only modified components during upgrades for faster performance.
* Major: Checksum system overhaul: more robust payload handling, better core vs non-core validation, and automatic checksum refresh after WP/plugin/theme upgrades.

= 19.2 =
* Feature: Major performance optimization for checksums.
* Feature: Enhanced SaaS API integration with signature verification.
* Feature: Compatibility check for plugin version.
* UX: Improved license validation and error messages.
* UX: Better handling of database vs file infections in UI.

= 19.1 =
* Feature: Introducing enhanced cleanup operations.

= 19.0 =
* Bugfix: Enhanced detection of suspicious empty files in core directories.
