DevDome Malware Scanner & Backdoor Cleaner Wordpress Plugin - Rating, Reviews, Demo & Download

No ratings yet

Free

Plugin Description

WordPress Malware Scanner & Backdoor Cleaner

DevDome Malware Scanner is a WordPress malware scanner, backdoor scanner and malware cleaner. It answers one question: is this site infected, backdoored, or carrying something that will reinfect it after cleanup?

It does not stop at “7 infected files found”. Every finding says what changed, why it is suspicious, how confident the scanner is, and what to do about it. Threats the plugin can close safely are fixed with one click. Everything else comes with plain-language advice and a link to the right place.

What the Scan Checks

• WordPress core files against the official checksums from WordPress.org, including unknown files inside wp-admin and wp-includes
• WordPress.org plugins against their official checksums, including unknown PHP files inside plugin folders
• WordPress.org themes against the official zip of the installed version: modified, missing and foreign files
• Premium and custom plugins and themes against a baseline, with a file change timeline from the second scan on
• PHP code with token-based static analysis: behavior chains such as request input to execution, decode to execution and remote download to disk write, not keyword matching
• Obfuscation: encoded blobs, entropy, chr() chains, hex escapes, nested decoders
• The uploads folder: executable files, disguised media (photo.jpg containing PHP), extension and content mismatches
• wp-config.php, .htaccess and .user.ini: auto-prepend directives, cloaking redirects, PHP handlers in uploads
• Must-use plugins and drop-ins, which load with full privileges and never appear in the plugin list
• Administrator accounts and capabilities, read from the capability values in usermeta, not just role labels
• WP-Cron events that can re-download a payload after every cleanup
• The database: script and iframe injections, encoded payloads, SEO spam and hidden links across options, posts, revisions and meta
• Known-malware signatures: byte patterns matched on this site and file hashes checked through your DevDome account (see below)
• Optionally, installed plugin, theme and WordPress versions against the WPVulnerability database, plus plugins closed on WordPress.org for a security issue

Findings You Can Act On

Severity (how bad it would be) and confidence (how likely it is malicious) are separate numbers, and every finding carries human-readable evidence: the signals that fired, the line, a short snippet with secrets removed. Every row expands to a detail panel with the facts that lead to a decision: file size, modified time, plugin and hash for a file; username, email, role and registered date for an account, with a link to the user profile; hook and next run for a scheduled task; the post or option for database content. For a modified core or plugin file, View what changed shows the lines that differ from the official copy before you decide.

The Overview shows a protection ring that reflects the worst open finding, the verdict in plain words, the critical and high counts, the number of files checked and how many threats can be fixed with one click. Areas the scan could not fully verify (excluded paths, oversized files, an unreachable checksum source) are listed as coverage gaps and never assumed clean.

One-Click Cleanup

One click fix closes every back door the plugin can fix safely and reversibly: known malware, executables hidden in uploads, unexpected files in core and high-confidence malicious code are moved to quarantine; modified core and WordPress.org plugin files are replaced with the official copy. The scan then runs again so the clean verdict is verified, not assumed.

Threats that need a human stay under Needs your decision with a plain explanation and a link to the right place: theme files (replacing them changes your design), injected database content, new administrator accounts, suspicious cron tasks, configuration files, software with a known security hole. Files WordPress cannot boot without are never moved by the plugin.

Quarantine, Not Deletion

A quarantined file is removed from disk and its contents are kept as a compressed, non-executable copy in the plugin’s own database table, together with the original path, SHA-256, size and permissions; nothing executable is ever written anywhere on disk. It can be restored at any time from the Quarantine tab, and the restored file is verified against the recorded hash. A file is reported as quarantined only after its database record is written; if the record fails, the file is put back. Deleting a quarantined file permanently is a separate, explicit action.

Trusted Repair

A modified core or WordPress.org plugin file is put back by WordPress itself: the current file is backed up to quarantine first, then the WordPress updater reinstalls the same installed version from WordPress.org (the same code path as Dashboard > Updates > Re-install, or Plugins > Add New > Upload > Replace), and the result is verified against the official checksum. The plugin never writes into core, plugin or theme folders and never edits files surgically; a failed reinstall puts the original back.

Reinfection Risks

Removing infected files alone does not clean a site that keeps a rogue admin, a cron beacon or a planted must-use plugin behind. These are tracked on their own Reinfection risks tab, with a Neutralize action: an unknown administrator loses its admin rights (the account stays and can be restored under Users), a planted must-use plugin or drop-in moves to quarantine, a suspicious scheduled task is removed. The tab also lists every must-use plugin and drop-in present on the site, and the Advanced Overview shows a Reinfection risks card while any remain. A neutralized threat that comes back is reported again as reappeared.

Built for Shared Hosting

Scans run in short time-boxed batches (8 seconds by default, adjustable) driven by the open admin page, with a WP-Cron fallback that keeps a scan going after you close the tab. Scans can be paused, resumed and cancelled. One engine failing does not destroy the scan: the failed stage is recorded as a coverage gap and the scan moves on. A scan that stops making progress is ended with the stage it died in instead of spinning forever.

Scheduled Scans and Alerts

Daily or weekly scans run around 02:00 site time. The plugin sends no email itself: on a site connected to a DevDome account, the account emails you after a scan that finds critical or high severity threats, at most once per scan. Clean scans and low-severity findings send nothing.

DevDome Account (optional)

The local scan is complete without an account: integrity checks, code analysis, uploads, configuration, users, cron, database and persistence engines all run on your server. Connecting a free DevDome account adds:

• The known-malware signature set: 90,000+ signatures from the Linux Malware Detect project, curated and served by DevDome. Byte-pattern signatures are stored on this site; the hash signatures stay on DevDome’s servers, and the SHA-256 and MD5 hashes of every scanned file are checked against them during each scan. Only hashes are sent, never file contents.
• Security status for all your sites in one DevDome dashboard, and an email to your account address when a scan finds critical or high threats.
• Enhanced analysis (separate opt-in): short suspicious code fragments and a file-path hint are sent for a second opinion. The plugin attempts to redact common credential and secret patterns before transmission; no redactor can guarantee that every secret format is removed.

Not connected: the file hash check and signature updates stop. Byte-pattern signatures already downloaded to this site keep matching after a disconnect; a site that never connected has none, runs on its built-in heuristics alone and says so in the coverage notes.

Simple and Advanced Views

The Simple view shows the verdict, the one-click cleanup and Settings. The Advanced view adds Threats with severity filters, search and bulk actions (Quarantine, Replace with official file, Trust this exact content, Ignore, False positive, Reopen), File Changes (last 90 days), Reinfection risks (Neutralize), Quarantine (Restore, Delete permanently, Remove from list) and Scan History. Every list pages the same way, with a per-page menu.

Multisite

On a network the scanner is a network administrator tool, because integrity checks, quarantine and repair touch shared core and plugin files. Each site keeps its own scan data; network deactivation clears scheduled scans on every site.

External services

The plugin talks to the following services:

1. WordPress.org APIs (api.wordpress.org, downloads.wordpress.org, core.svn.wordpress.org, plugins.svn.wordpress.org): used to fetch official core and plugin checksums, plugin directory status (whether an installed plugin was closed for a security issue), the official zip of each installed WordPress.org theme (downloaded during a scan to verify the theme’s files) and, on explicit repair or comparison actions, official file copies. Only your WordPress version, locale, plugin and theme slugs and their versions are sent. Terms: https://wordpress.org/about/privacy/ Privacy: https://wordpress.org/about/privacy/

2. DevDome Security API (analytics.devdome.com), only on a site connected to a DevDome account: (a) during each scan, the SHA-256 and MD5 hashes of every scanned file are checked against the DevDome database of 90,000+ known-malware signatures (hashes only, never file contents); (b) after every scan a summary (severity counts, the type, title, path and status of the top findings, the site’s wp-admin URL for the email button, the signature-set version and the plugin version) is sent so your DevDome dashboard shows the site’s security status and your account address gets an email when critical or high threats are found; (c) the byte-pattern signature set is delivered and updated through the account and stored on this site; the hash signatures stay on DevDome’s servers and are only ever queried by hash; (d) with the separate “Enhanced analysis” opt-in, short suspicious code fragments and a file-path hint are sent for a second opinion; the plugin attempts to redact common credential and secret patterns before transmission, but no redactor can guarantee that every secret format is removed. Authentication is the site token the DevDome Dashboard provisioned on connect. Nothing is sent before you connect. Terms: https://devdome.com/terms-of-service Privacy: https://devdome.com/privacy-policy

3. WPVulnerability API (www.wpvulnerability.net), only when you switch on the vulnerability check in Settings (off by default): during a scan, the slugs and versions of your installed plugins, themes and WordPress core are checked against this free public vulnerability database (EUPL v1.2). Only slugs and version numbers are sent. Terms: https://www.robotstxt.es/legal/ Privacy: https://www.wpvulnerability.com/privacy/

Signature data source (not a service the plugin contacts): the signature set is the Linux Malware Detect database (GPLv2, rfxn.com project), imported and served by DevDome; the plugin never contacts rfxn.com. Project page: https://www.rfxn.com/projects/linux-malware-detect/ License (GPLv2): https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

1. Plugin catalog (devdome.com): the DevDome Dashboard inside wp-admin fetches the list of DevDome plugins (names, descriptions, logos, links, WordPress.org slugs) from https://devdome.com/wp-plugins/catalog.json at most once every 12 hours, and only after you have connected the site to a DevDome account; a site that is not connected never contacts devdome.com for it. Only the bundled core version is sent in the request; no site or visitor data. Terms: https://devdome.com/terms-of-service Privacy: https://devdome.com/privacy-policy

2. Connecting a DevDome account (optional): the DevDome Dashboard offers connecting a free DevDome account. Nothing is sent until you press the Connect button. If you do connect, the shared library sends your site address, a generated site ID and a generated secret site token to analytics.devdome.com/api/plugin/connect/start and /api/plugin/connect/claim to link this site to your account; afterwards it confirms the connection with api.devdome.com/plugin/account at most once every twelve hours, and tells api.devdome.com/plugin/disconnect when you disconnect. Terms: https://devdome.com/terms-of-service Privacy: https://devdome.com/privacy-policy

The local scan is fully functional without any external service.

Build

The admin stylesheet assets/devdome-tools-tw.css is compiled with Tailwind CSS from src/tw.css.
The build source ships with the plugin. To rebuild it:

1. npm install
2. npm run build

That runs tailwindcss -c ./tailwind.config.cjs -i ./src/tw.css -o ./assets/devdome-tools-tw.css --minify.
assets/admin.js is plain, unminified JavaScript and is edited directly; there is no build step for it.
The two inline header icons (bug report, save) are from Lucide (ISC licence).

Screenshots

1. 

   Overview: protection score, threats by severity, and the one-click fix that quarantines or repairs everything found.

2. 

   Threats and Findings: every finding with severity, status, file path and the evidence behind it, with bulk actions and search.

3. 

   File Changes: a 90-day log of every created, modified, quarantined, restored and repaired file.

4. 

   Reinfection risks: rogue administrators, must-use plugins, drop-ins and scheduled tasks that let an attacker back in.

5. 

   Quarantine: removed files kept as compressed, non-executable copies in the database, restorable at any time.

6. 

   Scan History: every scan with files checked, database rows checked and findings per severity.

7. 

   Settings: optional hash lookup and alerts through a DevDome account, vulnerability check, scan limits and excluded paths.

Similar Plugins:

DevDome Safe Media Cleaner Malcure Malware Scanner — #1 Toolset For WordPress Malware Removal MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall