Malware scanning
WPFixAgent's malware detection is self-built -- no third-party security vendor or external scanning API is involved. It checks WordPress core files against the official WordPress.org checksum manifest, and reviews plugin/theme/upload files for known-bad signatures and suspicious structural traits like unusual entropy or anomalous modification timing.
Independent
Detection
Official
Checksum manifest
Non-destructive
Quarantine
Never
Auto-deleted
Scan-to-resolution workflow
Core files, plugin/theme files, and uploads are checked for integrity and suspicious content.
Each finding is labeled signature (high-confidence match) or heuristic (structural, worth a look before acting).
A confirmed finding is moved to protected quarantine, hash-matched to the exact scanned file so nothing else is touched.
Restore a false positive, delete permanently once confirmed, or reinstall the parent plugin/theme from its official source.
A fresh scan confirms the finding is actually resolved.
Every WordPress core file is compared against the checksum manifest for the official WordPress.org release matching your installed version -- missing, modified, or unexpected files are flagged individually.
Known-bad patterns -- common obfuscation techniques, files sitting somewhere they never should, backdoor shells -- are matched directly and reported with high confidence.
Files without a known signature match can still surface for review based on unusual entropy, polyglot structure, or a modification time that doesn't fit the rest of the plugin or theme they're in.
A flagged file is moved into a locked, non-executable directory with a recovery manifest -- never deleted outright. Restore it in one click if a finding turns out to be a false positive.
If the affected file was actually part of a plugin or theme you still have installed, redownloading the current official release from WordPress.org and replacing every file closes the gap that quarantine alone doesn't -- see Core Integrity for how this extends to WordPress itself.
Independent detection -- no third-party vendor in the loop
Quarantine is always reversible, never a silent delete
Checksum comparison uses the official WordPress.org manifest
Not a substitute for full incident response after a confirmed compromise
Practical guidance
Critical errors
Recover from the WordPress critical error screen with a controlled process that protects evidence, creates a restore point, isolates the cause, and verifies the result.
Read guideAuto repair
Automation should resolve known, reversible WordPress conditions while risky database, malware, and hosting failures remain review-driven.
Read guideBackups
Local restore points make repairs fast, while off-site copies protect against hosting and disk failure. A serious recovery plan needs clear roles for both.
Read guideFAQ
No. Detection logic is built and run entirely by WPFixAgent -- no external malware-scanning API or vendor is involved.
No. The file is disabled and moved to a locked directory with a recovery manifest. Restore or permanently delete it yourself once you've reviewed it.
Restore it from the Quarantine tab in one click -- nothing about the file or the surrounding plugin/theme was altered.
No. For a confirmed, actively-exploited compromise, this scanner is one tool among several a full incident response would use -- it doesn't replace specialist review.
Free 14-day trial · no card required
Install the connector, pair with a one-time token, and start monitoring in minutes -- upgrade whenever you're ready.