The ScanTitan WordPress Malware Scanner Online checks your pages, scripts and PHP code for injected JavaScript, hidden iframes, malicious redirects, backdoors and SEO spam. Each finding comes with what was seen and where it sits, and the report lists the areas the scan could not check. There is no plugin to install, so it works even when an infection has locked you out of wp-admin.
Enter your WordPress site URL and run the free quick check. Create a free account for the full scan and weekly monitoring.
A WordPress malware scanner looks for code and content an attacker planted on your site: injected scripts, hidden iframes, spam pages, redirects and backdoors. ScanTitan inspects pages, scripts and responses, compares them with known malware patterns and lists each finding with what it saw and, when known, the URL, script or file path.
No scanner finds everything, so the report also lists what was not checked, such as pages behind a login, and never shows those areas as clean. A finding is a lead to confirm, not proof, because a legitimate ad or analytics script can look suspicious and cause a false positive.
The scan runs on ScanTitan, not inside your site. That means no plugin, no server agent and no DNS change, no load on your hosting, and a scan that still works when the infection has locked you out of wp-admin.
Six stages, from identifying WordPress to a verified rescan. The scan runs on ScanTitan, and each stage says what it checks so you know what the report covers.
ScanTitan detects the CMS and chooses checks fitted to WordPress sites: theme and plugin output, scripts and server responses.
The scan walks your public pages and collects every script, iframe and link, including code loaded from other domains.
Page content and scripts are compared with known malware patterns: obfuscated JavaScript, injected iframes, spam links and cloaked content.
Pages are requested as different kinds of visitors, which finds redirects that fire only on a first visit or only on mobile.
Backdoor and web shell patterns such as eval loaders and obfuscated PHP are flagged, with the file path when known.
You get findings with severity and location, plus a list of the areas that were not checked.
Scan before you change anything on a suspect site. The first report is your evidence, and it is what the rescan is compared against, so you can prove the cleanup worked.
Many WordPress infections show a clean page to the logged in owner and to search crawlers, and attack everyone else. A redirect can fire on the first visit, only on mobile, or only when the visitor arrives from a search result. A scan that reads one copy of a page sees only what the server chose to send that one time.
ScanTitan compares how pages respond to different visitors, which is how it finds visitor-specific redirects. Read behavioral malware detection for how it works.
Scan from outside your office network, because your own IP address and your logged in session can hide the problem. Ask a colleague to open the site on a phone from a Google result.
ScanTitan finds and verifies. You, your host or a security professional do the cleaning, and our website malware removal guide gives the steps. After the cleanup, run the same scan again. A clean result means the checks that ran found nothing, and it does not guarantee the site is safe.
Weekly checks catch a reinfection, because Free, Professional and Business plans repeat malware checks every week. Alerts are not guaranteed to arrive in real time.
Attackers choose places that owners rarely open and that survive a casual check. A scan finds what these places change in your pages and lists the file path when it knows it. The table shows each location and how to check it by hand, which is what you need when a finding points at a file or when the scan is clean but the symptoms continue.
| Location | What attackers hide there | How to check it by hand |
|---|---|---|
| wp-content/themes | Injected JavaScript and PHP loaders in functions.php, header.php and footer.php | Look for long encoded strings, eval or base64 calls and script tags you did not add. |
| wp-content/plugins | Backdoors inside legitimate plugins, and hidden plugins that stay active | Run wp plugin verify-checksums --all and delete plugins you do not use. |
| wp-content/mu-plugins | Code that loads on every request and never shows in the Plugins screen | List the folder. Any file you did not put there is suspect. |
| wp-content/uploads | PHP web shells disguised as images | Run find wp-content/uploads -name "*.php". No PHP belongs in uploads. |
| .htaccess | Redirect rules that fire only for mobile or search visitors | Compare it with the default WordPress rules and remove rules you cannot explain. |
| wp-config.php | Injected includes and stolen database credentials | Read it by hand and look for code after the database settings. |
| Database tables | Rogue administrators, injected script tags and changed site URLs | Sort users by registration date and search posts for script and iframe tags. |
For the code patterns attackers use to hide these files, see our guide to obfuscated PHP malware. For the manual cleanup, follow website malware removal.
Each type of infection hides in a different place. Use the guide for the type you suspect. The last column is what ScanTitan checks today, so you know where to look yourself.
| Type | What it does | Where it hides | Guide | Scan covers |
|---|---|---|---|---|
| Injected JavaScript | Loads scripts from other domains, steals data or redirects | Theme files, plugin files, database | - | Yes |
| Malicious redirects | Sends some visitors to scam or phishing pages | .htaccess, JavaScript | Read the guide | Yes |
| SEO spam | Adds pharma, gambling or Japanese keyword pages | Cloaked pages, database | Read the guide | Yes |
| Backdoors and web shells | Gives the attacker remote access that survives a password change | Uploads, mu-plugins, theme files | Read the guide | Yes, patterns |
| Phishing pages | Fake login or payment pages in site folders | Subfolders, uploads | - | Yes |
| Card skimmers | Copies payment details at checkout | Checkout page scripts | - | No dedicated detection |
One scan, one report. Each item below is a check that runs on your WordPress site, and each finding in the report names the check that raised it.
Obfuscated scripts and code loaded from domains you do not own, including base64 payloads in theme and plugin output.
Frames that load another site inside your pages, usually placed in footers and widgets where owners never look.
Redirects set in .htaccess or JavaScript, including ones that only fire on a first visit, on mobile or from a search result.
Fake login or payment pages planted in site folders, which get the whole domain flagged by browsers.
PHP shells, eval loaders and obfuscated re-downloaders that give an attacker a way back in, with the file path when known.
Encoded strings, gzinflate and base64 chains that hide what a PHP file really does. Paste a file into the code analyzer for a closer look.
Injected pharma, gambling and Japanese keyword pages, hidden links and cloaked content that only search engines receive.
Pages are compared across different visitors, so infections that hide from the owner and from crawlers still show up.
The report names what the scan could not check, such as pages behind a login, and never shows those areas as clean.
Obfuscated scripts and code loaded from domains you do not own, including base64 payloads in theme and plugin output.
Frames that load another site inside your pages, usually placed in footers and widgets where owners never look.
Redirects set in .htaccess or JavaScript, including ones that only fire on a first visit, on mobile or from a search result.
PHP shells, eval loaders and obfuscated re-downloaders that give an attacker a way back in, with the file path when known.
Encoded strings, gzinflate and base64 chains that hide what a PHP file really does. Paste a file into the code analyzer for a closer look.
Fake login or payment pages planted in site folders, which get the whole domain flagged by browsers.
Injected pharma, gambling and Japanese keyword pages, hidden links and cloaked content that only search engines receive.
Pages are compared across different visitors, so infections that hide from the owner and from crawlers still show up.
The report names what the scan could not check, such as pages behind a login, and never shows those areas as clean.
A malware scanner finds what is on the site now: injected scripts, backdoors, SEO spam and redirects. It tells you the site is infected. A vulnerability scanner finds the weakness that let the attacker in, such as an outdated plugin with a published CVE.
After an infection, the malware scan shows what to clean and the vulnerability scan shows what to fix so it does not return. Cleaning without fixing invites the same attack again.
Reactive. Finds scripts, redirects, backdoors and spam that are on the site now.
Proactive. Finds outdated plugins, themes and core. See the WordPress vulnerability scanner.
Run the malware scan first, then the vulnerability scan, then clean and rescan.
The report is a list you can act on, not a score. Keep the first report, because the rescan after your cleanup is the proof that a finding is gone.
Every finding is ranked Critical, High or Medium, so you start with the web shell, not the cosmetic issue.
The URL, script address or file path where the finding sits, so you know which file to open.
A short description of the code or behavior that raised the finding, so you can judge a false positive yourself.
Pages behind a login and anything else the scan could not reach are listed, never shown as clean.
Confirm the finding, replace the file or remove the code, then rescan. See the removal guide.
Run the same scan after the cleanup and compare it with the first report.
Illustrative example with a reserved example.test name. Not a real scan.
Scan on a schedule, and again at the moments when an infection is most likely or most costly to miss. A clean scan is a snapshot of one day, since new plugin flaws appear daily and attackers reinfect cleaned sites.
Right away
When you see a redirect, a browser warning or spam in search results, scan first so the evidence stays intact.
After changes
New code is the most common way malware arrives, especially from outside the official directory.
After a move
A restored backup can bring an old infection back with it. Scan before you point visitors at the new site.
Every week
Free, Professional and Business plans run malware checks weekly. Alerts are not guaranteed real time, so keep updates and backups current.
Three kinds of tool scan WordPress for malware, and each sees a different part of the site. None sees everything, so the strongest setup combines two. ScanTitan is the online kind and has no WordPress plugin on purpose.
| Online scanner (ScanTitan) | WordPress plugin | Host or server scanner | |
|---|---|---|---|
| Nothing to install in WordPress | ✓ | ✗ | Usually |
| Works when you are locked out of wp-admin | ✓ | ✗ | ✓ |
| Finds redirects only some visitors see | ✓ | Partial | ✗ |
| Reads every file and database row on the server | Partial | ✓ | Files only |
| Runs outside the infected environment | ✓ | ✗ | ✗ |
| Uses your hosting resources | No | Yes | Yes |
| Works on Joomla, Drupal and custom PHP | ✓ | ✗ | ✓ |
| Cleans the site for you | ✗ | Some | Some |
Short answers on scanning, limits and cleanup.
A WordPress malware scanner checks a WordPress site for malicious code such as injected scripts, hidden iframes, redirects, backdoors and spam pages, then reports what it found and where. Some scanners run inside WordPress as plugins, and others scan from outside. ScanTitan scans from outside and lists the areas it could not check.
Yes. Enter your address and read the report. There is no plugin, no server agent and no DNS change, and the scan works even if the infection has locked you out of wp-admin. Confirm that you own the site or have permission to scan it.
The quick check is free. It samples one public page and its scripts in about 45 seconds. A free account adds the full scan and weekly malware monitoring, and the pricing page lists what each plan includes.
Look for redirects, browser warnings, Search Console Security issues, spam pages in Google results, unknown administrators and PHP files in wp-content/uploads. Then run a scan, because the quietest infections show no symptom at all.
The scan checks for web shell and backdoor patterns such as eval loaders and obfuscated PHP, and reports the location when known. A backdoor that never reaches a public page can still be missed, so also run the manual checks in the table above.
No. ScanTitan finds the infection, shows where it is and rescans after the cleanup so you can confirm the site is clean. You, your host or a security professional do the cleaning, and our website malware removal guide gives the steps.
Yes. A legitimate ad, analytics or chat script can look like injected code. Treat each finding as something to confirm: open the file or page, check whether you added it and compare it with the official copy before you delete anything.
Scan weekly, and after every plugin, theme or hosting change. ScanTitan Free, Professional and Business plans run weekly malware monitoring. A single clean scan only proves the day it ran.
A malware scan finds malicious code already on the site. A vulnerability scan finds the weakness, such as an outdated plugin, that lets an attacker add it. After an infection, run both, then fix the weakness before you rescan.
It scans WooCommerce stores like any WordPress site, and it also scans Joomla and Drupal sites. ScanTitan has no dedicated card skimmer detection, so a store that takes payments should also ask its payment provider about script monitoring.
We would rather tell you now than after you have signed up.
Run the free quick check, keep the report, and scan again after the cleanup. ScanTitan finds and verifies. You or your host do the cleaning.
OSCP · CISSP · 12 years in web application security · Author profile →
One scan finds the infection and a second shows how it got in. Pick the tool that matches where you are.
