Find malware in your
WordPress site
before Google does.
Scan any theme or plugin for backdoors, injected code, and 40+ known vulnerability patterns — full report in under 10 seconds.
Detection Engine
9 vulnerability classes. 40+ patterns.
Every pattern was reverse-engineered from real WordPress infections found in the wild — not generic rules.
Backdoors & Remote Code Execution
Hidden shell scripts that let attackers run arbitrary commands on your server. Often injected silently after a plugin vulnerability is exploited.
// Obfuscated backdoor detected:
$_=str_rot13('riny');
$_(base64_decode($GLOBALS['x']));
Obfuscated Malware
Malicious code disguised as legitimate PHP using multi-layer encoding. Passes visual inspection but executes harmful payloads at runtime.
// Layered encoding to hide malware: eval(gzinflate(str_rot13( base64_decode($payload) )));
SQL Injection & XSS Risks
Unsanitized user input passed directly to database queries or rendered in HTML. Common in legacy themes using deprecated mysql_* functions.
// Vulnerable: unescaped output echo $_GET['search']; // Vulnerable: raw SQL concat $q = "SELECT * WHERE id=".$_GET['id'];
Spam & SEO Malware
Hidden links and cloaked content injected to boost other sites' rankings. Google penalises your domain — not the attacker's.
// Hidden pharma spam link:
echo '<div style="display:none">
<a href="https://pills.ru">
buy cheap meds</a>
</div>';
Weak Credentials & Hashing
MD5 password hashing, hardcoded credentials, and use of weak random number generators where cryptographic strength is required.
// Broken: MD5 is not a password hash $stored = md5($password); // Broken: weak random token $token = rand(100000, 999999);
Server & Config Leaks
phpinfo() calls, error display enabled in production, and var_dump() left in live code expose server paths, PHP version, and loaded modules to attackers.
// Exposes full server config:
phpinfo();
// Exposes DB credentials path:
ini_set('display_errors', 1);
Process
How it works
Three steps. No technical knowledge required.
Upload your code
Drag & drop a ZIP of your theme or plugin, or provide the server path. Supports files up to 150 MB on premium.
Deep recursive scan
Every PHP, JS, and HTML file is checked against 40+ patterns — recursively through all subdirectories. Typical scan: under 10 seconds.
Actionable report
Issues are grouped by severity. Premium shows exact line numbers, step-by-step fix guides, and a secure replacement code snippet.
Pricing
Free is a good start.
Premium is the fix.
Free scans tell you something is wrong. Premium tells you exactly where it is and how to fix it — with a secure replacement you can paste straight into your code.
Get Premium AccessFrom $9.99/mo · Cancel anytime
From developers
Used by WordPress developers worldwide
"Caught a base64 backdoor in a client's old theme that had been there for over a year. The report was clear and the fix guide was exactly what I needed."
"Google flagged my site as dangerous and I had no idea why. This tool found 3 injected scripts in under 10 seconds. Cleaned up, site unflagged within 48 hours."
"We run this on every client site before delivery. It caught a Nulled plugin with a remote-include shell in it. Saved us a very awkward conversation with a client."
FAQ
Common questions
Your WordPress site might already be compromised.
Most injections go unnoticed for weeks. Upload your theme or plugin now and know for certain — it takes under 10 seconds.