WP Manifestindependent plugin directory
manifest / security / devdome-malware-scanner

DevDome Malware Scanner

Free WordPress malware scanner, virus scanner and malware removal. Backdoor detection, quarantine, trusted repair. Free alternative to Wordfence, Sucuri and MalCare.

by DevDome · github.com/devdomefamily/devdome-malware-scanner · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/devdomefamily/devdome-malware-scanner/archive/refs/heads/main.zip

Readme

DevDome Malware Scanner - free WordPress malware scanner, virus scanner and malware removal

The free alternative to Wordfence, Sucuri and MalCare for scanning and removing malware in WordPress. A WordPress malware scanner for detecting malware, backdoors, malicious code, infected files and reinfection risks. It scans WordPress files and database content, quarantines threats and safely repairs trusted files from the dashboard. It does not only find infected files: it also looks for the things that bring the malware back after a cleanup (rogue admins, cron beacons, planted must-use plugins) and keeps uncertain findings separate from confirmed threats.

DevDome Malware Scanner, free WordPress malware scanner and malware removal

Why DevDome Malware Scanner instead of the alternatives

DevDome Malware Scanner Wordfence Sucuri MalCare Solid Security (iThemes) NinjaScanner GOTMLS Anti-Malware
Price Free Premium from $149 / year Platform from $199.99 / year from $99 / year Pro from $99 / year Scheduled scans from $19.50 / year Donation $29+ for definitions
Malware scan of files and database Yes Yes Server-side scan is paid Yes, on their cloud Basic Files Files
Malware removal for free Yes, quarantine and trusted repair Premium (Care plan) Paid Paid Partial No Free tier limited
Core, plugin and theme integrity against WordPress.org Yes Yes Core only Yes Core only Yes Core only
Backdoor and reinfection checks (rogue admins, cron, MU plugins, drop-ins) Yes, own tab with Neutralize Partial Partial Partial Partial No No
Quarantine with one-click restore, nothing deleted Yes No No No No Quarantine Auto delete
Severity and confidence shown separately Yes No No No No No No
Scan runs on your own server, no account required Yes Yes Plugin yes, scan no No, cloud Yes Yes Yes
Scheduled scans free Yes Yes Paid Paid Yes Paid Yes

Prices are the vendors' published plans in September 2026. Wordfence, Sucuri and MalCare keep malware removal in their paid tiers; DevDome does it in the plugin, with quarantine so nothing is ever deleted.

What it finds

  • Malware and malicious code
  • Backdoors and web shells
  • Modified WordPress core files
  • Modified plugin and theme files
  • Suspicious PHP files in uploads
  • Database injections and hidden spam
  • Rogue administrator accounts
  • Malicious WP-Cron tasks
  • Must-use plugins and drop-ins
  • Configuration file changes (wp-config.php, .htaccess, .user.ini)
  • Files that may reinfect the site after cleanup

Features

  • Scan files and database. WordPress core, every plugin and theme, uploads, must-use plugins, drop-ins and the configuration files; script and iframe injections, encoded payloads, SEO spam and hidden links in options, posts, revisions and meta.
  • Find backdoors and reinfection risks. Rogue administrators, cron beacons, planted must-use plugins and drop-ins on their own tab with a Neutralize action.
  • Safe malware cleanup. One click fix quarantines known malware and replaces modified core and WordPress.org plugin files with the official copy, then scans again to verify. A quarantined file is kept as a compressed, non-executable copy in the plugin's own database table and restores with one click.
  • File integrity checking. Official WordPress.org checksums for core and plugins, official theme zips, a baseline and change timeline for premium and custom code.
  • Severity and confidence are separate numbers. A known-signature match is 100% confidence; an entropy blob on its own is only a signal. Coverage gaps are listed and never assumed clean.
  • Scheduled malware scans. Daily or weekly, in short time-boxed batches with a WP-Cron fallback; pause, resume, cancel.
  • Works without an account. Every engine runs on your server. An optional free DevDome account adds 90,000+ known-malware signatures (hashes only are sent), a multi-site security dashboard and alert emails.
  • Simple and Advanced views, bulk actions, search, scan history, multisite support.
  • AI agents and MCP. 20 WordPress Abilities (WordPress 6.9+) covering every action: verdict, fix plan, findings, scans, one-click fix, every finding action, quarantine, logs, settings. See below.

Screenshots

WordPress malware scan overview with protection score, threat severity counts and one-click malware removal Malware Scan Overview: threat status, severity counts and safe cleanup actions.

Malware and backdoor findings list with severity, status, file path and evidence for each suspicious file Malware and Backdoor Findings: suspicious files, malicious code and the evidence behind each finding.

File integrity log of created, modified, quarantined and repaired WordPress files over 90 days File Changes: created, modified, quarantined and repaired WordPress files over time.

Reinfection risks tab listing rogue administrators, malicious cron jobs, must-use plugins and drop-ins Reinfection Risks: rogue admins, malicious cron jobs, must-use plugins and drop-ins.

Malware quarantine with restorable non-executable copies of removed files Malware Quarantine: quarantined files, restorable at any time.

Malware scan history with files checked, database rows checked and findings per severity Scan History: previous malware scans and detected threats.

Malware scanner settings: DevDome account features, vulnerability check, scan limits and excluded paths Settings: optional account features, vulnerability check, scan limits and excluded paths.

AI agents and MCP (WordPress Abilities API)

Since 1.2.0, on WordPress 6.9 and newer, DevDome Malware Scanner registers the whole plugin as WordPress Abilities: 20 abilities covering every action of the screens. An AI agent or MCP client connected to the site through the official WordPress MCP Adapter discovers them automatically, so you can ask Claude, ChatGPT or Cursor "is this site infected, what would one-click fix do, mark the finding about my own plugin as a false positive and schedule weekly scans". Every ability runs under the same administrator capability as the screens (network administrator on multisite); permanent deletion is annotated destructive.

Ability What it does
get-security-summary Verdict, protection score, open findings by severity, one-click fixable vs needs-decision, reinfection risks, last scan, coverage gaps, signature status, account state
get-fix-plan What One click fix would do, what needs a decision, what needs a rescan, with the plain-language reasons
get-findings Findings with severity, status, object_type, type, reinfection_only, search, paging; each with the actions that apply
get-finding-details Facts, redacted evidence and advice for one finding
get-finding-diff Lines that differ from the official WordPress.org copy (core and plugin files)
get-scan-progress Status, stage, percent, files and rows scanned
get-scan-history Previous scans with counts and errors
get-quarantine Quarantined copies; include_history for restored and deleted
get-file-changes Files created, modified, quarantined, restored, repaired (90 days)
get-event-log The scanner event log, filterable by type
get-settings Every setting, account state, signature status, next scheduled scan, view mode
run-malware-scan Start a full scan (background)
control-malware-scan Pause, resume, cancel
fix-all One click fix: quarantine known malware and planted files, restore modified core and plugin files from WordPress.org (batched, call again while remaining > 0)
finding-action quarantine, repair, trust, false_positive, ignore, acknowledge, reopen, neutralize (demote a rogue admin, unschedule a cron task, quarantine a planted file) with the screen's safety rules
restore-quarantined Put a quarantined file back (hash verified)
delete-quarantined Delete a stored copy permanently (destructive) or remove a restored / deleted record from the list
update-settings deep_scan_max_kb, batch_seconds, exclusions, schedule (rescheduled at once), vuln_intel, account features on connected sites
set-view-mode simple or advanced screen for the current user
sync-signatures Start or force the signature download (connected sites)

Try it: install the MCP Adapter, create an application password for an administrator, then add the site to Claude Code:

{"mcpServers":{"my-site":{"type":"http","url":"https://example.com/wp-json/mcp/mcp-adapter-default-server","headers":{"Authorization":"Basic <base64 user:application-password>"}}}}

Requirements

WordPress 6.0+, PHP 7.4+. Every scanning engine runs on your own server; no account needed.

Installation

  1. In wp-admin go to Plugins > Add New, search for DevDome Malware Scanner, install and activate.
  2. Open Malware Scanner in the admin menu and press Scan Now. The first scan verifies integrity and seeds the file baseline; later scans add the change timeline.

Part of the DevDome plugin family

Free WordPress plugins by DevDome: Analytics (cookieless, bot and AI crawler split, public API and MCP server), Malware Scanner, Redirect Manager, Media Cleaner, Link Monitor, Affiliate Manager. Every plugin ships with the DevDome Dashboard inside wp-admin, so the others install in one click.

Development

This repository mirrors the release published on WordPress.org. Bug reports and feature requests: open an issue here or use the support forum.

License

GPL-2.0 or later. See LICENSE.

Read the full README on GitHub →