DevDome Malware Scanner - free WordPress malware scanner, virus scanner and malware removal

The free alternative to Wordfence, Sucuri and MalCare for scanning and removing malware in WordPress. A WordPress malware scanner for detecting malware, backdoors, malicious code, infected files and reinfection risks. It scans WordPress files and database content, quarantines threats and safely repairs trusted files from the dashboard. It does not only find infected files: it also looks for the things that bring the malware back after a cleanup (rogue admins, cron beacons, planted must-use plugins) and keeps uncertain findings separate from confirmed threats.

• Install from WordPress.org: https://wordpress.org/plugins/devdome-malware-scanner/
• Website: https://devdome.com
• Support: https://wordpress.org/support/plugin/devdome-malware-scanner/

Why DevDome Malware Scanner instead of the alternatives

	DevDome Malware Scanner	Wordfence	Sucuri	MalCare	Solid Security (iThemes)	NinjaScanner	GOTMLS Anti-Malware
Price	Free	Premium from $149 / year	Platform from $199.99 / year	from $99 / year	Pro from $99 / year	Scheduled scans from $19.50 / year	Donation $29+ for definitions
Malware scan of files and database	Yes	Yes	Server-side scan is paid	Yes, on their cloud	Basic	Files	Files
Malware removal for free	Yes, quarantine and trusted repair	Premium (Care plan)	Paid	Paid	Partial	No	Free tier limited
Core, plugin and theme integrity against WordPress.org	Yes	Yes	Core only	Yes	Core only	Yes	Core only
Backdoor and reinfection checks (rogue admins, cron, MU plugins, drop-ins)	Yes, own tab with Neutralize	Partial	Partial	Partial	Partial	No	No
Quarantine with one-click restore, nothing deleted	Yes	No	No	No	No	Quarantine	Auto delete
Severity and confidence shown separately	Yes	No	No	No	No	No	No
Scan runs on your own server, no account required	Yes	Yes	Plugin yes, scan no	No, cloud	Yes	Yes	Yes
Scheduled scans free	Yes	Yes	Paid	Paid	Yes	Paid	Yes

Prices are the vendors' published plans in September 2026. Wordfence, Sucuri and MalCare keep malware removal in their paid tiers; DevDome does it in the plugin, with quarantine so nothing is ever deleted.

What it finds

• Malware and malicious code
• Backdoors and web shells
• Modified WordPress core files
• Modified plugin and theme files
• Suspicious PHP files in uploads
• Database injections and hidden spam
• Rogue administrator accounts
• Malicious WP-Cron tasks
• Must-use plugins and drop-ins
• Configuration file changes (wp-config.php, .htaccess, .user.ini)
• Files that may reinfect the site after cleanup

Features

• Scan files and database. WordPress core, every plugin and theme, uploads, must-use plugins, drop-ins and the configuration files; script and iframe injections, encoded payloads, SEO spam and hidden links in options, posts, revisions and meta.
• Find backdoors and reinfection risks. Rogue administrators, cron beacons, planted must-use plugins and drop-ins on their own tab with a Neutralize action.
• Safe malware cleanup. One click fix quarantines known malware and replaces modified core and WordPress.org plugin files with the official copy, then scans again to verify. A quarantined file is kept as a compressed, non-executable copy in the plugin's own database table and restores with one click.
• File integrity checking. Official WordPress.org checksums for core and plugins, official theme zips, a baseline and change timeline for premium and custom code.
• Severity and confidence are separate numbers. A known-signature match is 100% confidence; an entropy blob on its own is only a signal. Coverage gaps are listed and never assumed clean.
• Scheduled malware scans. Daily or weekly, in short time-boxed batches with a WP-Cron fallback; pause, resume, cancel.
• Works without an account. Every engine runs on your server. An optional free DevDome account adds 90,000+ known-malware signatures (hashes only are sent), a multi-site security dashboard and alert emails.
• Simple and Advanced views, bulk actions, search, scan history, multisite support.
• AI agents and MCP. 20 WordPress Abilities (WordPress 6.9+) covering every action: verdict, fix plan, findings, scans, one-click fix, every finding action, quarantine, logs, settings. See below.

Screenshots

Malware Scan Overview: threat status, severity counts and safe cleanup actions.

Malware and Backdoor Findings: suspicious files, malicious code and the evidence behind each finding.

File Changes: created, modified, quarantined and repaired WordPress files over time.

Reinfection Risks: rogue admins, malicious cron jobs, must-use plugins and drop-ins.

Malware Quarantine: quarantined files, restorable at any time.

Scan History: previous malware scans and detected threats.

Settings: optional account features, vulnerability check, scan limits and excluded paths.

AI agents and MCP (WordPress Abilities API)

Since 1.2.0 (hardened in 1.2.1), on WordPress 6.9 and newer, DevDome Malware Scanner registers the whole plugin as WordPress Abilities: 20 abilities covering every action of the screens. An AI agent or MCP client connected to the site through the official WordPress MCP Adapter discovers them automatically, so you can ask Claude, ChatGPT or Cursor "is this site infected, what would one-click fix do, mark the finding about my own plugin as a false positive and schedule weekly scans". Every ability runs under the same administrator capability as the screens (network administrator on multisite). Every action that changes the live site or hides a threat (One click fix, quarantine, repair, neutralize, trust, ignore, false positive, restore, permanent delete, lowering protection, enabling cloud analysis) requires confirm: true, so an agent has to ask the user first; finding-action and delete-quarantined are annotated destructive. Agent output carries no absolute server paths, e-mails or secrets.

Ability	What it does
get-security-summary	Verdict, protection score, open findings by severity, one-click fixable vs needs-decision, reinfection risks, last scan, coverage gaps, signature status, account state
get-fix-plan	What One click fix would do, what needs a decision, what needs a rescan, with the plain-language reasons
get-findings	Findings with severity, status, object_type, type, reinfection_only, search, paging; each with the actions that apply
get-finding-details	Facts, redacted evidence and advice for one finding
get-finding-diff	Lines that differ from the official WordPress.org copy (core and plugin files)
get-scan-progress	Status, stage, percent, files and rows scanned
get-scan-history	Previous scans with counts and errors
get-quarantine	Quarantined copies; include_history for restored and deleted
get-file-changes	Files created, modified, quarantined, restored, repaired (90 days)
get-event-log	The scanner event log, filterable by type
get-settings	Every setting, account state, signature status, next scheduled scan, view mode
run-malware-scan	Start a full scan (background)
control-malware-scan	Pause, resume, cancel
fix-all	One click fix (confirm: true): quarantine known malware and planted files, reinstall modified core and plugins from WordPress.org with every file the reinstall touches backed up to quarantine (batched, call again while remaining > 0)
finding-action	quarantine, repair, trust, false_positive, ignore, acknowledge, reopen, neutralize (demote a rogue admin, remove a scheduled task incl. events with arguments, quarantine a planted file); only the actions the screen offers for that finding; confirm: true for the six that change the site or hide a threat; WordPress core files are repair-only
restore-quarantined	Put a quarantined file back (hash verified, permissions verified, rolled back if anything fails; confirm: true); repair backups restore over the reinstalled official file
delete-quarantined	Delete a stored copy permanently (confirm: true, destructive; an unfinished delete can be finished by deleting again) or remove a restored / deleted record from the list
update-settings	deep_scan_max_kb, batch_seconds, exclusions, schedule (rescheduled at once), vuln_intel, account features on connected sites; every value is read back before updated: true; lowering protection or turning cloud code analysis on needs confirm: true
set-view-mode	simple or advanced screen for the current user
sync-signatures	Start or force the signature download (connected sites)

Try it: install the MCP Adapter, create an application password for an administrator, then add the site to Claude Code:

{"mcpServers":{"my-site":{"type":"http","url":"https://example.com/wp-json/mcp/mcp-adapter-default-server","headers":{"Authorization":"Basic <base64 user:application-password>"}}}}

Requirements

WordPress 6.0+, PHP 7.4+. Every scanning engine runs on your own server; no account needed.

Installation

1. In wp-admin go to Plugins > Add New, search for DevDome Malware Scanner, install and activate.
2. Open Malware Scanner in the admin menu and press Scan Now. The first scan verifies integrity and seeds the file baseline; later scans add the change timeline.

Part of the DevDome plugin family

Free WordPress plugins by DevDome: Analytics (cookieless, bot and AI crawler split, public API and MCP server), Malware Scanner, Redirect Manager, Media Cleaner, Link Monitor, Affiliate Manager. Every plugin ships with the DevDome Dashboard inside wp-admin, so the others install in one click.

Development

This repository mirrors the release published on WordPress.org. Bug reports and feature requests: open an issue here or use the support forum.

License

GPL-2.0 or later. See LICENSE.