Check for Malware and Malicious Code in WordPress App

anjanesh

Is there some standard procedure to check if my wordpress site is infected ?

Is there some tool that we can execute in shell or otherwise ? I am hoping not to install a WP plugin to do the check because most of the Malware and Malicious Code come through plugins only.

peter

anjanesh A popular tool that you can use is located here: https://github.com/scr34m/php-malware-scanner

You can "git clone" it to a shell user's home directory, and then scan an app of your choice, like this:

# git clone
cd ~/
git clone https://github.com/scr34m/php-malware-scanner.git

# run scan
php ~/php-malware-scanner/scan -k -d ~/apps/<app_name>

Keep in mind that no automated malware scanner can be considered 100% accurate, so the scan results may contain false positives and there may be some infected/malware files that the scanner is unable to detect.

anjanesh

If WordPress core is affected then can WordFence plugin still work properly ?

peter

anjanesh I can't give you a "yes or no" answer to this question. It depends on the specifics of the security breach. If the infection has spread out across multiple files, including the WordPress core, then I wouldn't count on the WordFence plugin to reliably detect and/or clean up the malware. WordFence is generally good at protecting WordPress sites from attacks and it's worth having it as a preventive measure.