Website Security Blog: Vulnerability Scanning and Malware Guides

WordPress core files modified is a scanner alert that means a file in your install no longer matches the official release for your version. It is not always a hack.

The best Sucuri alternatives cover some or all of what Sucuri sells: a firewall, WordPress protection, hack cleanup and website scanning. This guide ranks six of them by how many

Is your website blacklisted by Google? Google has no single blacklist. A site can sit on Google’s Safe Browsing list, which triggers security warnings, carry a manual action, which is

A website flagged as phishing is a site that a browser, security vendor or email filter has classified as a fake login or credential trap. The cause is either a

.htaccess malware is malicious configuration code that an attacker writes into the Apache .htaccess file, which the server reads before WordPress loads. It can redirect search visitors, run image files

A cloaking hack in WordPress is malicious code that shows spam to Google and a normal site to you, so the dashboard and your own browser look clean while search

Nulled plugins malware is malicious code hidden in a pirated copy of a premium WordPress plugin, installed by an owner who wanted it for free. The code runs with the

A site still blocklisted after cleanup is rarely a mystery. The flag stays because you are still waiting for a review, part of the infection is still there, or a

Malicious JavaScript on website pages is script code that an attacker planted so it runs in your visitors’ browsers. It loads from a theme file, a database row, a third-party

WordPress mu-plugin malware is malicious PHP placed in the wp-content/mu-plugins folder, where WordPress loads it on every request without activation, so it never shows as an active plugin. Attackers use

Hidden admin user WordPress infections are administrator accounts that exist in the database but are filtered out of the Users screen by code, so the dashboard shows nothing unusual. Attackers

The 12 signs of website malware fall into five groups: what visitors see, what Google shows, what you see in the dashboard, what the server’s files and logs show, and

To find a backdoor in a website, run three passes: compare every file against a clean copy, search for code that behaves like a backdoor, and trace unusual requests in

How did my website get hacked? Almost always through one of nine entry points: a vulnerable plugin or theme, stolen credentials, a nulled theme, a compromised hosting account, vulnerable custom

A seo spam hack is an attack that injects spam pages, links or redirects into your site so the attacker can rank pharmacy, casino or counterfeit-goods pages on your domain.

Database malware WordPress owners miss is malicious code, links or settings stored in database rows instead of files, which is why file scanners and file restores never catch it. It

WordPress malware keeps coming back when cleanup removed what you could see and left the way back in. The usual causes are a surviving backdoor, a hidden admin user, a

Obfuscated PHP malware is malicious PHP code that an attacker has scrambled so scanners and site owners cannot read it at a glance. The scrambling uses encoding, string tricks and

The 15 different types of malware below are the families every security guide names, and each one is explained from a site owner’s point of view: what it does to

When your website is hacked, what to do first is contain it, copy it and only then clean it. This website hacked what to do guide gives the order for

A clean malware scan is a report that says the scanner found nothing it recognizes, and it is not proof that a site is clean. When a malware scanner says

A malicious redirect is code that sends visitors from your page to a spam, scam or malware site without their consent. It often fires only for some visitors, which is

The Japanese keyword hack is a form of SEO spam hack in which attackers inject thousands of auto-generated Japanese pages into a compromised website. It works by cloaking: Google and

A web shell is a server-side script that an attacker can use to maintain remote access to a compromised web server. Depending on its capabilities and the privileges of the

The Deceptive Site Ahead warning is a red Chrome screen that appears when Google Safe Browsing detects behavior associated with phishing or social engineering on a page. For visitors, it

A website malware cleanup is the ordered process you follow to remove malware from website files and databases without leaving a way back in. It runs in six steps: contain

Magecart is the name for criminal groups that steal payment card data from online checkout pages, usually by planting JavaScript that copies card details while the real purchase goes through.