Moatline Malware Scanner

Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake “verify you’re human” pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.

Set-up wizard and a simpler layout

• A two-minute set-up wizard after you activate the plugin: tell it what kind of site this is and who logs in, and it builds a protection plan with a reason for each item. Nothing changes until you click Apply, and every change can be undone at the end.
• Six tabs: Overview, Scan & Clean, Protect, Advisor, Activity and Settings. Protect groups everything by the kind of attack (Files & code, Logins, Spam & bots, Users & admins), with one button per group to turn on what’s recommended for your site.
• Simple and Advanced views: Simple shows the main switches, Advanced adds the fine-tuning.

“I think I’ve been hacked”

• A checklist that walks you through what we do when we clean a hacked site: lock the site, run a full scan, remove what it found, change passwords and replace the security keys, check new users and plugins, and check outside WordPress (Search Console owners, your domain’s name servers, verification files and extra folders).
• Steps tick themselves off when Moatline can see they are done, and you get a summary to keep or send to a client.

Lock: one click, in the admin bar

• A padlock in the admin bar makes the site read-only for code and accounts.
• While locked, nobody can install, update, delete or edit plugins and themes, create users, make anyone an administrator, change the registration or site address settings, or upload code files. This stops attacks that come through stolen remote-management keys, plugin bugs and scripts.
• WordPress automatic updates keep running while the site is locked, and updates from Dashboard → Updates still work (you can switch that off).
• Unlock for 30 minutes or an hour with one click. The site locks itself again, and every unlock is logged and emailed.
• Optional: make unlocking ask for your password or two-factor code, so a stolen login can’t unlock the site either.
• Blocked attempts, such as a new administrator, are logged and emailed to you.

Security Advisor

• Looks at how your site is set up and used (shop, membership, Jetpack, other security plugins, backups, who logs in) and recommends what to turn on, with a one-line reason.
• Apply each recommendation with one click, apply all recommended at once, or hide the ones that don’t fit. Every change can be undone.
• Everything is worked out on your site. Nothing is sent anywhere.

Malware scanner

• Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.
• Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.
• Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.
• Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.
• Results name the malware family that matched, so you know what you’re dealing with.
• Checks WordPress core files against WordPress.org and finds files that don’t belong in wp-admin and wp-includes.
• Warns you when a plugin, theme or your WordPress version is under active attack, with an email the first time it happens.
• Automatic weekly scans in the background, with an email when something is found.
• File change monitoring: reports PHP and JavaScript files that are new or changed since the last scan, even when malware backdates them.
• Find the source: when a malicious script is found, names the file or database entry that keeps adding it back.
• WP-CLI commands for scans, results and database cleanup.

Content scan

Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.

• Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.
• Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.
• Ordinary scripts such as analytics or form embeds are not flagged.
• Each finding links straight to the post or widget so you can remove the injected code.

Integrity check against WordPress.org

Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.

• Files identical to the official release are verified clean and skipped, which keeps false positives low.
• Files that differ are flagged as modified. That is exactly where injected malware hides.

Two-factor login

• Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.
• Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.
• 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.
• Password logins over XML-RPC are refused for two-factor users, so the code screen can’t be bypassed. Apps use application passwords.

XML-RPC protection

• Three modes: allow, Jetpack-safe (only Jetpack’s signed requests are accepted) or block completely.
• Refuse password logins over XML-RPC and disable system.multicall, which attackers use to try hundreds of passwords in one request.
• Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.
• Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.

Login protection and access

• Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.
• Hide usernames from the REST API and block ?author= username scans.
• Block REST API batch requests from logged-out visitors, the door used by the wp2shell attacks on WordPress core.
• See every active login session with IP address and browser, including sessions left by deleted users.
• One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.
• Audit and revoke application passwords, or turn them off.

Every option that blocks something is off until you turn it on, and each one explains what it might affect.

Live monitoring

• Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).
• Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.

Lockdown

• One-click file modification lock (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS) so attackers can’t install or edit plugins and themes through the dashboard.
• Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).

Login security

• Move the login page to a custom URL and hide wp-login.php.
• Send bots probing the default login page to a 404.

Database cron cleaner

• Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click “Clean database”, and backs up everything it removes so you can restore it.

Activity log

• Records security-relevant events such as suspicious cron registrations, with export to JSON.

Security score

• A dashboard score and checklist that shows what to fix next.

Pro add-on

The free plugin finds and reports threats. The Pro add-on is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, one-click fixes for core files, server settings and database triggers, AI verification of findings, blocking of malware call-home connections (including blockchain gateways), daily scans, the full vulnerability database from Wordfence Intelligence, and a white-label security report for clients. Pro is never required to use the features above.

Links

• Website
• Documentation
• Changelog
• Report a security issue
• Support forum
• Email: [email protected]

External services

This plugin connects to WordPress.org to verify plugin and core files, and to moatline.io for a list of plugins under attack.

WordPress.org plugin checksums (https://downloads.wordpress.org/plugin-checksums/)

• What it’s used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.
• What is sent: the slug and version number of each installed plugin (for example contact-form-7 and 5.9), when you run a scan. No personal data, site content or file contents are sent.
• Provided by WordPress.org: Terms of Service and Privacy Policy.

WordPress.org core checksums (https://api.wordpress.org/core/checksums/1.0/)

• What it’s used for: comparing your WordPress core files with the official release, so files changed by malware are found.
• What is sent: your WordPress version number and language (for example 6.8.3 and en_US), when you run a scan.
• Provided by WordPress.org: Terms of Service and Privacy Policy.

If your server cannot reach WordPress.org, the scan continues without the integrity check.

Moatline list of plugins under attack (https://moatline.io/feeds/exploited.json)

• What it’s used for: warning you when a plugin or theme installed on your site has a security hole that attackers are exploiting right now.
• What is sent: nothing about your site. The whole list (a small file) is downloaded about twice a day and compared on your own site. Like any web request, it reveals your server’s IP address to moatline.io.
• Provided by Next Nova Technologies, the makers of this plugin: Terms of Service and Privacy Policy.

If your server cannot reach moatline.io, the copy of the list included with the plugin is used.

Credits

QR codes for two-factor login are drawn with qrcode-generator by Kazuhiko Arase (MIT licence), bundled in assets/js/vendor/qrcode.js.