When it comes to finding malicious code in WordPress there are two schools: automatic scanning and manual review. Both have their place, and relying on just one often misses something. Understanding the strengths and weaknesses helps you choose well — and know when it’s time to bring in help.
Automatic scanning: fast but shallow
Plugins and scanners are excellent at quickly catching known malware via signatures. They go through thousands of files in minutes and are a good first layer. But they miss what they’ve never seen — new variants, custom backdoors and code hidden in unexpected ways. They also produce false positives: legitimate code flagged as dangerous, which drowns real threats in noise and leads people to eventually ignore the warnings.
Manual review: thorough but slow
A human who knows WordPress can see what a signature list can’t: code that doesn’t belong, files with the wrong timestamp, suspicious database rows, a pattern that reveals a custom attack. Manual review judges context — is this file normal for this theme? It’s thorough, but it takes time and experience, and is impractical to do manually on every single file in a large install.
The best is the combination
The right method uses automation to do the heavy lifting — comparing all files against original core, scanning the database structure, flagging anomalies — and human review to judge the ambiguous and confirm the entry point. Automation finds the candidates; the human decides what’s actually malicious. That way you avoid both false alarms and missed backdoors.
Continuous beats one-time
A scan is a snapshot. A site that was clean yesterday can be infected tomorrow if a new vulnerability appears. That’s why continuous monitoring — regular scanning plus timely updates — is worth more than a single deep review. The best protection doesn’t just detect that something happened; it reduces the chance of it happening.
How we run it
Kepler Security Scan combines automated file comparison and database scanning with manual judgment — and a backup before every change, so nothing is removed blindly. Want continuous monitoring instead of a one-time scan? It’s included with Managed WordPress hosting, alongside monitored updates and daily backups.