If you suspect malware on your WordPress site, the Malware Scanner helps you find where the problem is.
The scanner is thorough. Some files can look suspicious even when they are safe. Review results before you delete anything.
Go to Security Ninja → Malware and click Scan your website. An overlay shows while the scan runs.
A scan can take a few seconds or several minutes, depending on how many plugins and files you have.
The scan checks plugins, themes, uploads, and other site files against known malicious patterns. Some WordPress core JavaScript paths are skipped by default. See how the Malware Scanner works for the full steps.
When the scan finishes, results appear on the same page with a summary strip and status banner. The page does not need a full reload.
The top of the results shows how many suspicious files were found. Each file appears in a table with severity and guidance.
On each row you can expand matched code samples, open View File in the File Viewer, whitelist the file, or delete it when you are certain it is malicious.
Some rows are structural findings (suspicious plugin or theme folder layout when wordpress.org checksums are not available). Treat those as review recommended, not automatic malware.
Whitelist a suspicious file
Whitelisting a file means it will not show up as a finding on the next scan. It appears in the list of whitelisted files instead.
Delete a suspicious file
Deleting a file from an active plugin can break the site. Confirm the file contains malicious code before you delete it. Removing a required plugin file can stop that plugin from working.
Why was a plugin marked as suspicious?
The scanner looks inside files for patterns that match known malware or risky code. A plugin on the list is not always infected. Part of its code may simply match something the scanner flags.
We keep improving the scanner to reduce false positives, while still catching real threats.
For cleanup after an infection, use the malware cleanup checklist.
