WPSniffer vs Linux Malware Detect (maldet)
Updated October 2026
Linux Malware Detect, usually called maldet or LMD, has been scanning shared-hosting servers for two decades and does more than scan: it quarantines, cleans and watches directories in real time. WPSniffer is narrower and newer. The two are complementary more often than they are rivals.
At a glance
| WPSniffer | Linux Malware Detect | |
|---|---|---|
| License | GPLv3 | GPLv2 |
| Cost | Free | Free |
| Written in | Python 3.8+ | Bash with a native scan engine |
| Install | pip into a virtualenv; no root needed | System-wide under /usr/local/maldetect; normally installed as root |
| Detection source | YARA Forge community rules plus your own YARA rules | LMD's own signatures: about 14,800 MD5 hashes, 2,000 HEX patterns and 780 YARA rules, plus optional ClamAV |
| Rules readable | ✓ Plain-text YARA | Partly: YARA and HEX signatures are readable, hash signatures are not |
| Engine | YARA-X | Native engine with MD5, HEX, YARA, ClamAV and string-length stages |
| Quarantine and clean | ✗ Reports only | ✓ -q, cleaner rules, restore |
| Real-time monitoring | ✗ | ✓ inotify (-m) |
| Recently changed files | Pipe find -cmin into stdin | ✓ -r PATH DAYS |
| Reports | CSV, TSV, delimited, human-readable, email | Scan reports, email, Slack, Telegram, Discord alerts |
| Custom rules | ✓ --rules | ✓ Custom signatures supported |
| Control panel integration | ✗ | ✓ Auto-detects 12+ panels for its daily cron |
| Telemetry | ✗ Only downloads rules | Downloads signatures; optional sample submission |
Two different approaches
maldet is a hosting-server security daemon in spirit: install it once as root, let its daily cron scan recently changed files across every account, watch home directories with inotify, quarantine what it finds and alert you. Its signatures come from network-edge intrusion detection systems and user submissions, and it layers hash, pattern, YARA and ClamAV detection.
WPSniffer does one thing: scan files with YARA rules and write a report. It installs per user without root, which matters on shared hosting where you are a customer rather than the administrator, and in CI pipelines where a system-wide install is impractical. Its rule set is the YARA Forge collection, which is larger and more diverse than maldet's 780 YARA rules but comes without the hash and HEX layers.
Detection coverage
Hash signatures catch exact copies of known samples and never produce false positives; they also miss every variant with one byte changed. YARA rules describe structure and behaviour, so they catch families and variants at the cost of occasional noise. maldet mixes both; WPSniffer is YARA only, but with roughly six times as many YARA rules from many authors, and it scans every file whole so filesize conditions behave correctly.
On WordPress-specific threats such as PHP webshells, obfuscated loaders and SEO spam injectors, both find the common families. Running both on the same tree is cheap and gives you the union of two independent signature sets, which is a reasonable practice during an incident.
Using them together
A common setup on a hosting server: maldet as the always-on layer with inotify and quarantine, WPSniffer as the deeper, readable second opinion. Feed maldet's recently changed files or a find list into WPSniffer, or scan the same roots nightly with both and diff the results:
$ sudo maldet -a /var/www
$ find /var/www -type f -ctime -1 -print0 | wpsniffer malware-scan --match-all --output-path ~/wps.csvWhere maldet quarantines automatically, keep WPSniffer in report-only mode and review its hits before acting; its broader rule set is more likely to flag an unusual but legitimate plugin.
When to choose which
- You administer the whole server and want quarantine, cleaning and real-time monitoring: maldet, with WPSniffer as a second scanner.
- You do not have root, or you are on shared hosting: WPSniffer.
- You want to read and write detection rules, or ship a curated rule set to many servers: WPSniffer.
- You need alerts in Slack, Telegram or Discord out of the box: maldet. WPSniffer's email summary or a short wrapper script covers simpler needs.
- You scan in CI or a container: WPSniffer, which needs only Python.