Guides
Practical, copy-and-paste guides for finding and dealing with malware on WordPress servers from the command line. Each one uses only free, open-source tools and takes minutes, not hours.
How to scan a WordPress site for malware over SSH
Connect over SSH, find the WordPress root, install WPSniffer in two minutes and scan every file against YARA malware rules, no plugin required.
How to find PHP webshells in wp-content/uploads
The uploads folder should never contain PHP. Find dropped webshells with find and YARA rules, quarantine them and block PHP execution so they cannot come back.
How to find recently modified files on a hacked WordPress site
Use find with ctime, not just mtime, to list files changed in the last hours or days, pipe them into a YARA scan, and verify WordPress core and plugin checksums.
How to scan all WordPress sites on a server
Count the WordPress installs on a server, scan them all in one run or one report per site, tune workers and keep the scan fast on large media libraries.
How to run a nightly malware scan with cron and get an email report
Set up a cron job or systemd timer that scans your WordPress sites every night, keeps dated reports, and emails you only when something is found.
What to do after a malware scan finds matches
Step-by-step cleanup after a scan reports matches: confirm, quarantine, find the entry point, restore clean code, rotate secrets, remove persistence, re-scan, harden.
Where to start
If you suspect a site is infected right now, read recently modified files first, then the cleanup checklist. If you are setting up monitoring for a server you run, start with scanning every site and the nightly cron job. Installing a new theme? Read how to choose a premium WordPress theme and scan it before you activate it.