Title: Deep Malware Cleaner
Author: Themepaste
Published: <strong>12. meje 2026</strong>
Last modified: 13. awgusta 2026

---

Tykače pytać

![](https://ps.w.org/deep-malware-cleaner/assets/banner-772x250.png?rev=3529934)

![](https://ps.w.org/deep-malware-cleaner/assets/icon-256x256.png?rev=3529934)

# Deep Malware Cleaner

 Wot [Themepaste](https://profiles.wordpress.org/themepaste/)

[Sćahnyć](https://downloads.wordpress.org/plugin/deep-malware-cleaner.1.0.6.zip)

 * [Podrobnosće](https://hsb.wordpress.org/plugins/deep-malware-cleaner/#description)
 * [Pohódnoćenja](https://hsb.wordpress.org/plugins/deep-malware-cleaner/#reviews)
 *  [Instalacija](https://hsb.wordpress.org/plugins/deep-malware-cleaner/#installation)
 * [Wuwiće](https://hsb.wordpress.org/plugins/deep-malware-cleaner/#developers)

 [Podpěra](https://wordpress.org/support/plugin/deep-malware-cleaner/)

## Wopisanje

**Deep Malware Cleaner** is a lightweight deep malware scanner built for WordPress.
It performs a thorough deep cleanup scan of your `wp-content` directory, verifies
your WordPress core files against the official checksums, detects backdoors, finds
injected site scripts, flags redirect hacks, and scans your database for hidden 
payloads — all from your WordPress admin dashboard, with no external service, no
subscription, and no scan data ever leaving your server.

Whether you’re dealing with a live attack, a hidden backdoor, or a redirect hack
silently sending visitors to malicious sites, Deep Malware Cleaner gives you the
tools to scan, alert, and act — fast.

Finding the infected file is only half the job. Deep Malware Cleaner also surfaces
the things attackers leave behind so a cleaned site stays clean: the second administrator
account, the scheduled event that re-downloads the payload, and the uploads directory
that will happily execute the next webshell.

#### Core Capabilities

**Deep Cleanup Scan**
 Walks your entire `wp-content` directory, inspecting PHP 
files plus the client-side formats most often used to deliver malware — JavaScript,
HTML, SVG, and `.htaccess` — for known signatures, obfuscated code, and injected
payloads. Results are sorted by severity so the worst threats surface first.

**Pre-Install Upload Guard**
 Scans plugins, themes, and risky media uploads (`.
php`, `.svg`, `.html`, `.js`, `.htaccess`) in their temporary directory _before_
WordPress moves them into place. If malware is detected the install or upload is
aborted and an error is shown — stopping a compromised package before it ever touches
your site. Can be toggled in Settings.

**Database Scanner**
 Inspects the most-targeted database tables — options, posts,
comments, and post meta — for injected scripts, hidden iframes, and encoded payloads,
using keyset pagination and a time budget so it stays safe on a live site.

**Core Integrity Check**
 Hashes every file of your WordPress installation and compares
it against the official checksums published by WordPress.org, so a patched `wp-login.
php` or a webshell hidden inside `wp-includes` cannot pass as a core file. Findings
are split into modified, unknown, and missing.

**Recently Modified Files**
 Lists every PHP file changed in the last 1–30 days,
newest first. After a break-in the attacker’s files are usually the newest ones 
on the site, which makes this the fastest way to spot an intrusion the signature
rules have not seen before.

**Admin User Audit**
 Reviews every administrator account for the patterns that 
give away an attacker-created login — added recently, an email on an unrelated domain,
no display name, or a machine-generated username. Read-only: no account is ever 
changed or removed for you.

**Cron Job Audit**
 Lists every WordPress scheduled event and flags the ones no 
active code listens for, or whose hook name looks obfuscated. If a site keeps getting
reinfected after a clean-up, a hidden cron event is the usual reason.

**Uploads Directory Protection**
 Blocks PHP execution in `wp-content/uploads` with
one click. Nothing you upload to WordPress is ever a PHP file, so denying PHP outright
turns a webshell dropped through a vulnerable plugin into a file the attacker cannot
run. Reversible at any time.

**Backdoor Fixer**
 Detects PHP backdoors uploaded through vulnerable plugins or
themes — including webshells, remote-execution scripts, and hidden PHP files inside
the uploads folder where no PHP should ever exist.

**Site Script Cleaner**
 Identifies injected JavaScript and malicious `<script>`
tags, hidden iframes, and obfuscated code blocks embedded in your theme or plugin
files.

**Redirect Hack Fix**
 Flags the PHP patterns most commonly responsible for redirect
hacks — including `header()` injection, variable-based shell execution, and compressed
payload backdoors used to silently redirect visitors to attack sites.

**Threat Triage**
 Review every finding on the scan results screen with its full
path, threat type, and severity, and dismiss anything you’ve confirmed is a false
positive with one click. One-click Quarantine and Restore are available in Deep 
Malware Cleaner Pro.

**Login Protection**
 Hardens your WordPress login against brute-force attacks and
unauthorized access attempts — an essential layer of website protection alongside
active scanning.

**Instant Alerts**
 Get notified the moment a scan finds a threat. Real-time alerts
keep you informed so you can respond before an attack escalates.

#### What the Scanner Detects

 * **eval(base64_decode(…))** — the most widespread PHP malware obfuscation and 
   attack vector.
 * **eval(gzinflate(…))** / **eval(gzuncompress(…))** — compressed-payload backdoors.
 * **eval(str_rot13(…))** — rotation-cipher obfuscated malware.
 * **Shell execution with dynamic arguments** — `shell_exec`, `passthru`, `proc_open`,`
   popen`, and `system` called with a variable, a classic attack pattern for remote
   code execution.
 * **Hidden iframes** — `<iframe>` elements injected with `display:none` used to
   load malicious content invisibly.
 * **Long base64 strings** — unusually large base64 blobs embedded in PHP, a common
   technique for hiding large attack payloads.
 * **Obfuscated JavaScript** — `eval(atob(...))` payload pairs and `javascript-obfuscator`(`
   _0x` hex identifier) fingerprints in JS, HTML, and SVG files.
 * **PHP files inside the uploads directory** — any `.php` file in `wp-content/uploads/`
   is flagged High severity; legitimate uploads are never PHP files.

#### Key Features

 * **Lightweight deep malware scanner** — reads only the first 64 KB of each file
   and runs under a strict time budget, so it stays fast and safe on shared hosting.
 * **On-demand and scheduled scans** — run manually with Start Scan, plus an optional
   automatic daily scan with email alerts.
 * **Deep Cleaner dashboard** — at-a-glance stats: threats found, files scanned,
   time since last scan.
 * **Website Security & Website Protection** — comprehensive coverage against the
   most common WordPress attack types.
 * **Troubleshoot mode** — detailed per-file reporting to help you understand exactly
   what was found and why it was flagged.
 * **Secure login** hardening included.
 * **All scan history** stored in your own database — nothing leaves your server.
 * **No account and no API key**, ever. The only outbound request the plugin makes
   is to WordPress.org for the official core checksums, and only when you run the
   Core Integrity check.
 * **Translatable** — all strings are internationalised and ready for translation
   via WordPress.org.

#### Deep Malware Cleaner Pro

Detection is free and always will be. **Deep Malware Cleaner Pro** adds the one-
click remediation engine on top:

 * **Quarantine** — moves an infected file to a protected directory that can never
   be executed or downloaded over HTTP, warning you first if the file belongs to
   an active plugin or theme.
 * **Restore** — puts a quarantined file back exactly where it was, so a false positive
   is never a lost file.

[Learn more about Deep Malware Cleaner Pro](https://themepaste.com/plugins/deep-malware-cleaner/)

#### Who Is This For?

 * Site owners who received a „this site may be hacked“ alert from Google.
 * Developers who need to troubleshoot a suspected redirect hack or injected script.
 * Agencies that manage multiple WordPress sites and need a fast, lightweight scanner
   with no SaaS dependency.
 * Anyone who wants ongoing website security and website protection without a monthly
   fee.

#### Privacy

No scan data ever leaves your site. Results, alert history, and audit findings live
only in your own WordPress database, and are removed when you uninstall the plugin
if that option is enabled in Settings. There is no account, no API key, and no third-
party service involved.

The plugin makes exactly one external request, and only when you click **Run Integrity
Check** on the Core Integrity screen: it fetches the official file checksums for
your WordPress release from `https://api.wordpress.org/core/checksums/1.0/` — the
same public endpoint WordPress core itself uses. The request carries only your WordPress
version and site locale; no file contents, scan results, or site data are transmitted.
Responses are cached for 12 hours. If you never open that screen, the plugin makes
no outbound requests at all.

WordPress.org’s privacy policy applies to that request: https://wordpress.org/about/
privacy/

## Fota wobrazowki

[⌊Dashboard — At-a-glance security overview showing a threat alert notice, scan 
statistics (total scans run, threats found, files scanned, time since last scan),
and quick-access buttons to run a new scan or open Settings.⌉⌊Dashboard — At-a-glance
security overview showing a threat alert notice, scan statistics (total scans run,
threats found, files scanned, time since last scan), and quick-access buttons to
run a new scan or open Settings.⌉[

**Dashboard** — At-a-glance security overview showing a threat alert notice, scan
statistics (total scans run, threats found, files scanned, time since last scan),
and quick-access buttons to run a new scan or open Settings.

[⌊Malware Scanner — One-click scan launcher with a live progress indicator, followed
by the Last Scan Results section displaying a threat detection notice and the full
results table.⌉⌊Malware Scanner — One-click scan launcher with a live progress indicator,
followed by the Last Scan Results section displaying a threat detection notice and
the full results table.⌉[

**Malware Scanner** — One-click scan launcher with a live progress indicator, followed
by the Last Scan Results section displaying a threat detection notice and the full
results table.

[⌊Scan Results — Detailed results table listing each flagged file with its full 
path, threat type (e.g. eval_base64), and severity badge (HIGH / MEDIUM) so you 
know exactly what was found and where.⌉⌊Scan Results — Detailed results table listing
each flagged file with its full path, threat type (e.g. eval_base64), and severity
badge (HIGH / MEDIUM) so you know exactly what was found and where.⌉[

**Scan Results** — Detailed results table listing each flagged file with its full
path, threat type (e.g. `eval_base64`), and severity badge (HIGH / MEDIUM) so you
know exactly what was found and where.

[⌊Settings — Configure email alert notifications, set the alert recipient address,
and manage scan data retention with the Remove Data on Uninstall option.⌉⌊Settings—
Configure email alert notifications, set the alert recipient address, and manage
scan data retention with the Remove Data on Uninstall option.⌉[

**Settings** — Configure email alert notifications, set the alert recipient address,
and manage scan data retention with the Remove Data on Uninstall option.

## Instalacija

#### Automatic Installation

 1. In your WordPress admin, go to **Plugins  Add New**.
 2. Search for **Deep Malware Cleaner**.
 3. Click **Install Now**, then **Activate**.

#### Manual Installation

 1. Download the plugin zip file.
 2. In your WordPress admin, go to **Plugins  Add New  Upload Plugin**.
 3. Choose the zip file and click **Install Now**, then **Activate**.

#### After Activation

 1. Go to **Malware Cleaner  Settings** to configure login protection, alerts, and 
    data-management options.
 2. Go to **Malware Cleaner  Run Scan** and click **Start Scan** to run your first 
    deep cleanup scan.

## HSP

### Will this plugin slow down my site for visitors?

No. The scanner runs only when you click Start Scan in the admin. It does not hook
into page loads or run any background cron jobs. Visitor-facing performance is completely
unaffected.

### Which files does the deep cleanup scan inspect?

The scanner reads PHP-family files (`.php`, `.php3`, `.php4`, `.php5`, `.php7`, `.
phtml`, `.phar`) plus the client-side formats most often used to deliver malware—
JavaScript (`.js`, `.mjs`), HTML (`.html`, `.htm`), `.svg`, and `.htaccess` — inside
your `wp-content` directory. To stay fast on shared hosting, it reads only the first
64 KB of each file (malware is injected at the top) and runs under a 20-second time
budget per run.

### What does „PHP file in uploads“ mean?

Legitimate image, video, and document uploads are never `.php` files. If the scanner
finds any PHP file inside `wp-content/uploads/`, it is almost certainly a backdoor
uploaded through a vulnerable plugin or theme — a High severity threat that should
be removed immediately.

### Can it fix or delete infected files?

The free plugin detects and reports threats, and lets you dismiss findings you’ve
confirmed are false positives. Automatically moving an infected file out of harm’s
way — one-click **Quarantine**, with **Restore** to put it back — is available in
Deep Malware Cleaner Pro. Without Pro you can still remediate manually: use the 
reported file path to remove or clean the file over SFTP or your host’s file manager.
Always review the file path and threat type before deleting anything.

### What is included in Deep Malware Cleaner Pro?

Pro adds the one-click remediation engine: **Quarantine** safely moves an infected
file to a protected, non-executable location (with a warning first if the file belongs
to an active plugin or theme), and **Restore** puts it back if a detection turns
out to be a false positive. Everything else — the file scan, database scan, pre-
install upload guard, scheduled scans, email alerts, and login protection — is included
in the free plugin.

### Is any data sent outside my site?

Your scan results never leave your site — they are stored only in your own WordPress
database. The plugin makes one external request, and only when you run the Core 
Integrity check: it downloads the official checksums for your WordPress version 
from api.wordpress.org, sending nothing but the version number and locale. If you
never use that screen, no outbound request is made at all.

### What does the Core Integrity check actually compare?

Every file in your WordPress installation is hashed with MD5 and compared against
the official checksum list for your exact version and locale. **Modified** means
a core file’s contents no longer match the official release — the strongest single
signal of a compromise. **Unknown** means a PHP file exists inside `wp-admin` or`
wp-includes` that is not part of WordPress at all. **Missing** means a file in the
checksums is not on disk, which some hosts cause by stripping optional files and
is usually harmless.

### The integrity check says files are modified. What now?

Do not edit them by hand. Reinstall WordPress from **Dashboard  Updates  Re-install
now**, which overwrites every core file with a clean copy and leaves your content,
themes, and plugins alone. If files are still flagged afterwards, restore from a
backup taken before the infection.

### A cron event is flagged as „Unknown Hook“ — is my site hacked?

Not necessarily. The most common cause is an ordinary plugin that was deactivated
or deleted without unscheduling its events, which leaves a hook behind that nothing
listens for any more. Treat it as worth a look, not as proof. An event that is flagged**
both** as an unknown hook **and** as having an obfuscated name is far more suspicious,
since legitimate plugins do not name their hooks with random hex strings.

### Why does the admin audit flag an account I created myself?

The flags describe patterns, not verdicts. An administrator you added last week 
is correctly flagged as a new account, and a colleague using a Gmail address is 
correctly flagged as an external email — both are perfectly normal. The audit’s 
job is to make sure no administrator on the list is one you cannot account for. 
Nothing is ever changed or deleted automatically.

### Is it safe to block PHP in my uploads directory?

Yes, on almost every site. WordPress stores images, video, and documents in `wp-
content/uploads`, and none of those need PHP to run. Blocking it is one of the standard
hardening steps recommended for WordPress. A small number of plugins do place PHP
files there and expect to execute them; if something breaks, click **Remove Protection**
and the rules are removed cleanly, leaving any other `.htaccess` content in that
directory untouched.

### I use Nginx. Does the uploads protection work?

No — `.htaccess` files are read by Apache and LiteSpeed, and ignored entirely by
Nginx. The plugin detects this and says so on the screen rather than writing rules
that would never take effect. On Nginx, ask your host to deny PHP execution under`
wp-content/uploads` in the server configuration.

### How does login protection work?

Login protection limits repeated failed login attempts and helps prevent brute-force
attacks against your `wp-login.php` endpoint — a key layer of website security that
works alongside the malware scanner.

### How do I troubleshoot a scan that flagged an unexpected file?

Go to **Malware Cleaner  Scan Results** and click the file path to view the matched
pattern. The troubleshoot view shows the exact line and rule that triggered the 
alert, so you can decide whether it is a false positive or a real threat.

### How do I remove all plugin data when I uninstall?

Go to **Malware Cleaner  Settings**, enable **Remove all data on uninstall**, then
deactivate and delete the plugin. All database tables, scan history, and plugin 
options will be removed automatically.

### The scan finished but I expected more files to be checked. Why?

To stay safe on resource-constrained servers, the file scan runs under a 20-second
time budget and the database scan under its own 10-second budget. On a very large`
wp-content` directory the file scan stops when the budget is reached, so a single
run may not reach every file. Run the scan again to continue checking, and remediate
the highest-severity findings first.

## Pohódnoćenja

Za tutón tykač pohódnoćenja njejsu.

## Sobuskutkowarjo a wuwiwarjo

„Deep Malware Cleaner“ je softwara wotewrjeneho žórła. Slědowacy ludźo su k tutomu
tykačej přinošowali.

Sobuskutkowarjo

 *   [ Themepaste ](https://profiles.wordpress.org/themepaste/)
 *   [ Md. Habibur Rahman ](https://profiles.wordpress.org/habibnote/)

[Přełožće „Deep Malware Cleaner“ do swojeje rěče.](https://translate.wordpress.org/projects/wp-plugins/deep-malware-cleaner)

### Na wuwiću zajimowany?

[Přehladajće kod](https://plugins.trac.wordpress.org/browser/deep-malware-cleaner/),
hladajće do [SVN-repozitorija](https://plugins.svn.wordpress.org/deep-malware-cleaner/)
abo abonujće [wuwiwanski protokol](https://plugins.trac.wordpress.org/log/deep-malware-cleaner/)
přez [RSS](https://plugins.trac.wordpress.org/log/deep-malware-cleaner/?limit=100&mode=stop_on_copy&format=rss).

## Protokol změnow

#### 1.0.6

 * Added Core Integrity — verifies every WordPress core file against the official
   WordPress.org checksums and reports modified, unknown, and missing files.
 * Added Recent Files — lists PHP files modified in the last 1–30 days, newest first,
   so post-intrusion changes are easy to spot.
 * Added Admin Users — audits every administrator account for new registrations,
   external email domains, missing display names, and machine-generated logins. 
   Read-only.
 * Added Cron Jobs — lists all scheduled events and flags hooks that no active code
   listens for, orphaned events, and obfuscated hook names.
 * Added one-click uploads directory protection on the Run Scan screen, blocking
   PHP execution in wp-content/uploads. Rules are written with WordPress’s own marker
   helpers, so existing .htaccess content is preserved on both add and remove, and
   Nginx servers are detected and told what to do instead.
 * Quarantining a file now returns a short „worth checking next“ summary — flagged
   admin accounts, flagged cron events, unresolved database findings, and whether
   uploads still allow PHP.
 * Privacy documentation updated: the Core Integrity check is the plugin’s only 
   outbound request, it is made only when you run that check, and it sends nothing
   but your WordPress version and locale.

#### 1.0.5

 * Quarantine and Restore are now part of Deep Malware Cleaner Pro. Scanning, detection,
   reporting, and Ignore remain free and unchanged.
 * Scan results now show a clear upgrade prompt in place of the Quarantine and Restore
   buttons when Pro is not active, and the corresponding AJAX endpoints refuse those
   actions server-side.
 * Added the `deepmacl_is_pro`, `deepmacl_pro_upgrade_url`, `deepmacl_pro_quarantine`,
   and `deepmacl_pro_restore` filters so the Pro add-on can hook in.
 * Refactored the file cleaner so the security-critical helpers — path-traversal
   checks, active plugin/theme detection, and quarantine directory hardening — live
   in one audited place shared by both editions.
 * Admin notices now render at the top of the Dashboard, Scanner, and Settings screens
   instead of being pushed below the page header.
 * Documentation updated to describe the free feature set accurately.

#### 1.0.4

 * Fixed scan results ordering so the highest-severity threats are listed first (
   previously medium-severity rows could appear above high-severity ones).
 * Reduced false positives from the long-base64 rule on minified JavaScript, inline
   data URIs, and source maps — the rule now applies only to PHP files in both the
   file scan and the pre-install upload guard.
 * The „Block malicious uploads“ setting now defaults to on at activation for consistency.
 * Documentation updated to match current scanning behaviour (file types inspected,
   time budgets, pre-install upload guard, and database scanner).

#### 1.0.3

 * Added database scanner — inspects wp_options, wp_posts, wp_comments, and wp_postmeta
   for injected malware, obfuscated code, and hidden payloads.
 * Hardened all database queries with fully prepared statements using identifier
   placeholders.
 * Switched file permission checks to the WordPress filesystem API.
 * Raised the minimum supported WordPress version to 6.2.
 * Resolved Plugin Check warnings for full WordPress.org compliance.

#### 1.0.2

 * Added automatic daily scans with email alerts when threats are found.
 * Added email reports after every scheduled or manual scan.
 * Added safe quarantine system — quarantine, ignore, or restore suspicious files
   easily.
 * Added protection for active plugins/themes to prevent accidental site damage.
 * Added uploads folder protection to block PHP execution in wp-content/uploads/.
 * Added Status and Actions columns in scan results for easier management.
 * Improved database updates — new columns are added automatically without manual
   setup.
 * Fixed plugin deployment — Composer files are now included, so no server-side 
   Composer setup is needed.

#### 1.0.1

 * Added malware auto-purge (delete / quarantine flagged files from the results 
   screen).
 * Added login protection module.
 * Added real-time threat alerts.
 * Improved site script cleaner detection for injected JavaScript and hidden iframes.
 * Enhanced redirect hack fix detection patterns.

#### 1.0.0

 * Initial release.
 * On-demand deep cleanup scan covering eight malware pattern types.
 * Backdoor fixer, site script cleaner, and redirect hack fix detection.
 * Admin dashboard with scan statistics.
 * Settings page with data-management option.

## Meta

 *  Version **1.0.6**
 *  Last updated **3 njedźele**
 *  Active installations **20+**
 *  WordPress version ** 6.2 abo nowši **
 *  Tested up to **7.0.4**
 *  PHP version ** 7.4 abo nowši **
 *  Language
 * [English (US)](https://wordpress.org/plugins/deep-malware-cleaner/)
 * Tags
 * [backdoor](https://hsb.wordpress.org/plugins/tags/backdoor/)[malware](https://hsb.wordpress.org/plugins/tags/malware/)
   [malware scanner](https://hsb.wordpress.org/plugins/tags/malware-scanner/)[scanner](https://hsb.wordpress.org/plugins/tags/scanner/)
   [security](https://hsb.wordpress.org/plugins/tags/security/)
 *  [Rozšěrjeny napohlad](https://hsb.wordpress.org/plugins/deep-malware-cleaner/advanced/)

## Pohódnoćenja

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/deep-malware-cleaner/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/deep-malware-cleaner/reviews/)

## Sobuskutkowarjo

 *   [ Themepaste ](https://profiles.wordpress.org/themepaste/)
 *   [ Md. Habibur Rahman ](https://profiles.wordpress.org/habibnote/)

## Podpěra

Chceće něšto prajić? Trjebaće pomoc?

 [Forum pomocy pokazać](https://wordpress.org/support/plugin/deep-malware-cleaner/)