Sitecommand
Sign inStart free

Malware sweep and cleanup

Weekly WordPress malware sweeps with cleanup you can undo

Modern malware hides in settings, code snippets and must-use files, and rebuilds itself when you delete one piece. The sweep looks in all of them, every week.

Start free Read the setup guide
Weekly sweep · dental-clinic.comInfected

2

critical

3

worth a look

1,284

files checked

Code snippet stores malicious codeSwitched off, comes back if Code Snippets is reinstalledcritical
PHP file in uploadswp-content/uploads/2026/11/admin.phpcritical
Administrator added since last sweepregistered 3 days agolook

Plan cleanup

Where it looks

The places malware actually hides.

Files

Against the official WordPress.org copies and your own baseline, so new and edited files stand out.

Uploads and odd places

PHP where it should never be, and files hidden behind media names.

Administrators

Hidden admins, new admins and new application passwords.

Code snippets

Including switched-off ones that would run again later.

Settings and tasks

Database settings, scheduled tasks and .htaccess rules.

Page content

Injected scripts, hidden links and known malware markers.

Cleanup

A plan you read before anything moves.

Cleanup proposes each step and why. You run it from the dashboard. Files go to quarantine, never deleted, and every step can be restored. WordPress core and active plugin files get a by-hand step instead.

Cleanup planRun cleanup
  • Empty the snippet's codekept in quarantine
  • Move uploads/2026/11/admin.phpto quarantine
  • Delete 4 malware settingsvalues kept
  • wp-includes/version.php differsby hand: reinstall WordPress

Every step can be restored from the cleanup history.

Scores you can trust

Clean, worth a look, or infected.

  1. 01

    Clean

    Nothing changed that should not have.

  2. 02

    Worth a look

    Something changed that a person should check, such as an edited plugin file.

  3. 03

    Infected

    Clear signs of malware. An incomplete sweep is never shown as clean.

FAQ

Questions

How often does it run?+

Weekly on a day you choose per site, or daily. Sweep now runs one any time.

What does it look for?+

Known malware markers, files that differ from the official WordPress and plugin copies, new or hidden PHP files, code hidden in the database and in code snippet plugins, and new administrators or application passwords.

Will it flag my legitimate files?+

It can flag something worth a look. Findings are scored as infected or worth a look, and nothing is moved until you review the plan and run it.

Why does malware keep coming back after I clean it?+

Usually something rebuilds it: a snippet, a must-use plugin or a database option. The cleanup plan removes those together, and Code Lock stops new code being added while the site is locked.

Can the AI clean a site?+

An AI can run a sweep and prepare the cleanup plan. Running it stays with the account owner, in the dashboard.

Keep reading

Related

Code LockCode Lock blocks plugin installs, code snippets, code changes and new administrators on a site until you unlock it. Posts, pages and orders keep working.Read SecurityHow Sitecommand protects sites: a secret per site, signed requests, encrypted storage, changes inspected before they run, and Code Lock to block code entirely.Read Safe updatesEach update gets a restore point and a front-page check. If the site breaks, it rolls back by itself. Plugins, themes and WordPress core across all your sites.Read

The sites keep running.
So do you.

Connect your first site in two minutes. Free during launch.

Start free How to connect a site