Something on your WordPress site feels wrong. Perhaps a visitor reported an unfamiliar redirect, or your host sent a warning. A malware scan is a sensible next check, but its results need a little interpretation. A red warning does not always mean you should delete a file, and a clean result does not prove that every part of the site is safe.
This walkthrough uses Wordfence Free because its scan results give you concrete files and issues to review. It is based on the current Wordfence and WordPress documentation, not a claim that I scanned your website or tested a compromised installation. The screen labels may change with plugin updates.
Before you run a scan
- If the site handles payments or personal information and you suspect a compromise, contact your host or security responder promptly. Do not rely on one plugin scan as your whole incident response.
- Make a recoverable backup of the files and database. Keep a copy of the current state even if you suspect it is infected; it may help explain what happened.
- Write down the symptom, affected URLs, time, and any recent changes. If visitors are being sent to a suspicious domain, do not enter credentials there.
- Confirm you can still log in to WordPress and that the host has enough resources for a scan. If the site is already struggling, ask the host before starting a resource-heavy operation.
WordPress’s hacked-site guidance emphasizes describing the actual symptoms. If you only need help comparing tools, my security scanner comparison explains what different scanners check. Here, we will use one tool and read its findings.
Run a standard Wordfence scan
- In Plugins > Add New, install Wordfence Security from WordPress.org. Activate it and complete its license or email setup using the prompts for the current version.
- In the dashboard, open Wordfence > Scan. Leave the default Standard Scan selected for a first pass, then start a new scan.
- Wait for completion before interpreting the result. If it stalls or fails, record the message. A partial scan is not a clean bill of health.
- Open each result and note the severity, file or setting involved, and the action Wordfence offers. Do not press Delete All or Repair All just to clear the list.
Wordfence’s scan documentation describes Standard Scan as the usual starting point. It also explains that checks vary by scan type. If your host limits long-running processes, a failed scan may need the vendor’s troubleshooting steps or host help before you can trust its coverage.
What the findings actually mean
| Finding | How to think about it | Safer next step |
|---|---|---|
| A file appears malicious or unsafe | This needs prompt investigation, especially if the file is executable or appears in an unexpected location. | Preserve the path and a copy for your responder. Check the file details and involve the host or a security professional before removing it. |
| A WordPress core file differs or an unknown file is in a core directory | It could be malicious, a leftover file, or something the host placed there. | Compare it with the known WordPress release and ask the host about managed changes. Do not overwrite a file you cannot identify. |
| A plugin or theme file is modified | A developer, vendor, host, or attacker could have changed it. The warning alone does not establish which. | Use View Differences, check the change history, and back up custom work before considering Repair. |
| A plugin has a vulnerability or needs an update | This is an exposure to evaluate, not necessarily evidence of a current infection. | Confirm the affected version, make a backup, update on staging if possible, and test the site afterward. |
| A suspicious administrator account or URL is found | An unfamiliar account or injected URL can be a stronger compromise signal. | Preserve the details, restrict access as appropriate, and ask the host or responder to examine scope and entry point. |
| The scan finds no issues | No issue was detected by this scan with its current coverage and signatures. | If symptoms persist, do not stop. Check host logs, Search Console security reports, and the affected behavior. |
Wordfence documents these result types and actions in more detail. Its free malware signatures arrive after a delay relative to premium, according to Wordfence’s Free documentation. That is one reason a clean result cannot guarantee a clean site.
Do not treat every modified file as malware
This is where people can cause real damage. A modified theme file may contain an intentional customization. Repairing it from the official repository can erase that work. An unfamiliar file in a core folder may be a leftover from an update or something the host added. Those explanations do not make the warning harmless; they mean you should verify before deleting.
For a modified file, open the difference view, check whether your developer or host recognizes the change, and compare it with a clean copy of the exact plugin, theme, or WordPress version. Keep a backup. If you cannot explain a suspicious change, escalate rather than clicking Ignore to make the warning disappear.
What if Wordfence finds something serious?
- Save the scan result details and affected paths. Avoid posting sensitive file contents or credentials publicly.
- Tell your host what was found and whether visitors, checkout, or logins may be affected. For a business site, ask about containment and preserving logs.
- Have the scope checked, including administrator accounts, plugins, themes, database content, and other sites on the same hosting account where relevant.
- Clean or restore only with a plan that addresses the entry point. Otherwise, the same issue can return.
- After cleanup, update supported software, reset relevant credentials, and run a follow-up scan. Recheck the original symptom and key user journeys.
My malware-removal options guide explains the difference between scanner alerts, automated cleanup, and human incident response. If an unfamiliar redirect is the symptom, use the unexpected WordPress redirect guide to document it without blindly editing redirect rules.
A small checklist before calling the scan finished
- Did the scan complete successfully, or was it partial?
- Which warnings are confirmed, which need investigation, and which are explained customizations?
- Did you save the evidence before repair or deletion?
- Did the site’s original symptom go away for the affected visitor or URL?
- If a compromise was confirmed, did someone check how it happened and whether it could recur?
A scanner is useful because it turns a vague worry into a list you can investigate. It is not the whole answer. When the stakes are high, the best next step is often to pause, preserve what you found, and get the host or a qualified responder involved.
This is a documentation-based walkthrough, not a hands-on test report or an emergency malware-removal service. No screenshots of a scan are included because no disposable WordPress site was provided for a reproducible test.