Wordfence Scan: Find and Remove Malware, Scan Types and Fixing Results

This article is a localized edition of the Japanese original. Read the Japanese original

The Wordfence scanner compares WordPress core, plugin and theme files with the official distributed files and lists modified files, known malware patterns, suspicious code, plugins that need updating, and more. The screen labels in this article were checked against the files of Wordfence 9.1.0 as distributed on WordPress.org, as of November 2026. Labels may differ slightly if your admin is shown in another language.

Free vs. Premium (as far as scanning goes)

• Malware signatures (detection patterns) and firewall rules reach the free version 30 days later than Premium. New malware may go undetected on the free version.
• Scans run automatically on a schedule in the free version too. Choosing the scan times yourself with "Manually schedule scans" is a Premium feature.
• Some checks, such as checking for spam-sending IPs and whether the site is on a blocklist, run only on Premium.

Run a scan

Open Wordfence → Scan in the admin and click "Start New Scan." Progress is shown stage by stage, and the results appear below when it finishes. Depending on the size of the site and the server's performance, it takes from a few minutes to several tens of minutes.

Choose a scan type

Under "Scan Options and Scheduling" on the Wordfence → Scan screen, you can choose the scan type (Scan Type).

If you suspect an infection, run one High Sensitivity scan. The main options that High Sensitivity turns on are listed below; you can also select them individually with Custom Scan.

• Scan theme files against repository versions for changes (compares themes with the distributed versions)
• Scan plugin files against repository versions for changes (compares plugins with the distributed versions)
• Scan files outside your WordPress installation (also checks files outside WordPress)
• Scan images, binary, and other files as if they were executable (looks for PHP disguised as images and similar files)

If scans slow the server down, turn on "Use low resource scanning" to run the scan more slowly with less load.

Severity levels and how to read results

Results are grouped by severity into "Critical," "High," "Medium," and "Low." The main examples found in the plugin's files are:

Open a result to see the file path and the reason. If a WordPress core, plugin or theme file differs from the distributed version, use "View Differences" to see the diff; for other files, use "View File" to see the contents.

How to handle each result

There are also bulk actions, "Repair All Repairable Files" and "Delete All Deletable Files," but deleted files cannot be restored. Before running them, back up the whole site (files and database) and check the list of affected files. If suspicious code is inside a file the site needs to run, such as wp-config.php or the theme's functions.php, do not delete the file; remove only the suspicious part.

Verify files with WP-CLI

If WP-CLI is available on the server, you can also check for tampering independently of Wordfence.

# Verify WordPress core files against the official checksums
wp core verify-checksums

# Verify plugins distributed on WordPress.org (premium plugins are not covered)
wp plugin verify-checksums --all

# Reinstall core by overwriting its files (wp-content is not overwritten)
wp core download --force --skip-content

wp core download --force only overwrites files; it does not remove files an attacker added. Check and delete anything the verification reports as a file that should not be there. WP-CLI has no command to verify theme checksums, so reinstall themes from their source and compare.

Look for suspicious files by hand

Alongside the Wordfence results, searches like these help you find suspicious files. Not every file they report is malware (legitimate plugins sometimes use base64_decode), so look at the contents before deciding.

# PHP files in the uploads folder (normally it holds only images and other media)
find wp-content/uploads -type f \( -name '*.php' -o -name '*.phtml' \)

# PHP files containing common obfuscation patterns
grep -rlE 'eval\s*\(\s*(base64_decode|gzinflate|str_rot13)' wp-content --include='*.php'

# PHP files modified in the last 7 days
find . -type f -name '*.php' -mtime -7

What to do after finding an infection

Fixing files alone may not stop attackers from getting back in with stolen passwords or backdoors. Work through these steps in order:

1. Change the passwords for your hosting control panel and for FTP/SFTP.
2. Change the database user's password (change it in the hosting control panel or in MySQL first, then set DB_PASSWORD in wp-config.php to the same value).
3. Regenerate WordPress's login keys so that all logged-in users are logged out.
4. Regenerate administrator passwords, and delete any administrator accounts you do not recognize.

# 3. Regenerate the authentication keys and salts (wp-config.php)
wp config shuffle-salts

# 2. After changing the database password, update wp-config.php
wp config set DB_PASSWORD 'new-database-password'

# 4. Review the administrators and regenerate their passwords (they receive a change notification email)
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp user reset-password $(wp user list --role=administrator --format=ids)

wp config set DB_PASSWORD only rewrites wp-config.php; it does not change the password on the database side. Change it on the database side first, then run the command.

After that, run a Wordfence scan again and confirm that no problems remain. The overall cleanup process is also covered in "How to detect and remove malware from WordPress."

Clear Google’s “dangerous site” warning

When Google decides a site is dangerous, warnings appear in search results and in browsers. You ask for the warning to be removed in Google Search Console.

1. Verify ownership of the site in Search Console (if you have not already).
2. Open "Security Issues" under "Security & Manual Actions" and review the detected issues and sample URLs.
3. Fix every listed issue on every page.
4. Click "Request Review" and explain what happened and what you fixed and how.

According to Google's help, a review can take from a few days to a few weeks. Do not resubmit the same request before you get a decision.

Notes

• A clean scan result does not prove there is no infection. On the free version new malware signatures arrive 30 days late, so combine the scan with other methods (WP-CLI verification, checking file modification times).
• If you find an infection on shared hosting, check the other sites in the same account too, and contact the hosting company.
• After recovery, delete plugins and themes you do not use, and keep the rest up to date.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)