Scanning a WordPress site for malicious code isn’t a single action but several layers. The more of them you cover, the better your chance of finding everything — not just the obvious. Here are the four layers that together give a complete picture.
1. Compare against original core
WordPress core, themes and most plugins exist in known, unchanged versions. By comparing each file against the original from wordpress.org, injected code shows up immediately — a modified core file is almost always a red flag. This method catches what signature-based scanners miss, because it looks for difference, not a known signature. Pay special attention to PHP files in the uploads folder, where code should never exist.
2. Scan the database
A lot of malware hides not in files but in the database — injected scripts in posts and widgets, hidden admin accounts, or tampered rows in wp_options (a changed siteurl or scheduled jobs, for example). A file scan alone misses this entirely. Search for suspicious patterns like <script>, base64_decode and external URLs in the content tables.
3. Look for patterns, not just signatures
Signature-based plugins recognize known malware but miss new variants. Stronger signals are obfuscated code (base64, eval, gzinflate, str_rot13), files with timestamps that don’t match the rest, unusually large or small files, and code in places it doesn’t belong. It’s this kind of anomaly, rather than a signature match, that reveals custom attacks.
4. Read the logs
Access and error logs tell you how and when something happened: repeated POST requests to an unknown file, traffic to /wp-login.php from hundreds of IPs, or 500 errors from a file you don’t recognize. The logs help you find the entry point — and confirm it’s closed after the cleanup.
A scan is only as good as the layers it covers — files, database, patterns and logs, not just a signature list.
— Kepler Security Scan
When it’s time to get help
If the scan finds something — or if you’re not sure it would — let someone dig in. Kepler Security Scan combines file comparison, database scanning, pattern analysis and logs, and migrates the site to an isolated environment for cleanup with a backup before every change. And on Managed WordPress hosting, scanning and backups run as part of operations, not something you have to remember yourself.