Download the PHP package devdome/devdome-malware-scanner without Composer
On this page you can find all versions of the php package devdome/devdome-malware-scanner. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download devdome/devdome-malware-scanner
More information about devdome/devdome-malware-scanner
Files in devdome/devdome-malware-scanner
Package devdome-malware-scanner
Short Description Free WordPress malware scanner, virus scanner and malware removal. Backdoor detection, quarantine, trusted repair. Free alternative to Wordfence, Sucuri and MalCare.
License GPL-2.0-or-later
Homepage https://devdome.com
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package devdome-malware-scanner
DevDome Malware Scanner - WordPress Malware Removal & Security Scanner
WordPress malware scanner and virus scanner for hacked sites. Find malware, backdoors and malicious code, then remove it with quarantine and repair. Check files and database content, review supporting evidence and use quarantine or official package repair for eligible file findings. Scanning and cleanup work without an account; suspicious database content and configuration changes require your review.
The free alternative to Wordfence, Sucuri and MalCare for scanning and removing malware in WordPress.
- Install from WordPress.org: https://wordpress.org/plugins/devdome-malware-scanner/
- Website: https://devdome.com
- Support: https://wordpress.org/support/plugin/devdome-malware-scanner/
Why DevDome Malware Scanner instead of the alternatives
| DevDome Malware Scanner | Wordfence | Sucuri | MalCare | Solid Security (iThemes) | NinjaScanner | GOTMLS Anti-Malware | |
|---|---|---|---|---|---|---|---|
| Price | Free | Premium from $149 / year | Platform from $199.99 / year | from $99 / year | Pro from $99 / year | Scheduled scans from $19.50 / year | Donation $29+ for definitions |
| Malware scan of files and database | Yes | Yes | Server-side scan is paid | Yes, on their cloud | Basic | Files | Files |
| Malware removal for free | Yes, quarantine and trusted repair | Premium (Care plan) | Paid | Paid | Partial | No | Free tier limited |
| Core, plugin and theme integrity against WordPress.org | Yes | Yes | Core only | Yes | Core only | Yes | Core only |
| Backdoor and reinfection checks (rogue admins, cron, MU plugins, drop-ins) | Yes, own tab with Neutralize | Partial | Partial | Partial | Partial | No | No |
| Quarantine with one-click restore (restorable database copies) | Yes | No | No | No | No | Quarantine | Auto delete |
| Severity and confidence shown separately | Yes | No | No | No | No | No | No |
| Scan runs on your own server, no account required | Yes | Yes | Plugin yes, scan no | No, cloud | Yes | Yes | Yes |
| Scheduled scans free | Yes | Yes | Paid | Paid | Yes | Paid | Yes |
Prices reflect published plans in September 2026. Quarantine preserves a restorable copy; permanent deletion is a separate action.
What it finds: a security scan of files and data
Use the security scanner for a website security review or recurring security check:
- Malware, malicious code, backdoors and web shells.
- Modified core, plugin and theme files; suspicious PHP in uploads.
- Database injections, scripts, iframes, encoded payloads, seo spam and hidden links in options, posts, revisions and meta.
- Rogue administrators, malicious WP-Cron tasks and cron beacons.
- Planted must-use plugins and drop-ins that could enable reinfection.
- Suspicious changes to
wp-config.php,.htaccessand.user.ini.
For a website hacked through injected content, these checks help investigate a pharma hack, japanese keyword hack or redirect hack involving malicious redirects. Findings need review; a changed file alone does not prove infection.
Features
Malware detection and integrity check
The malware checker separates severity from confidence. Known-signature matches have 100% confidence; an entropy blob alone is a signal. Coverage gaps remain visible, supporting an evidence-based security audit.
An integrity check uses official core and plugin checksums and official theme packages. Premium and custom code use a baseline and change timeline; the baseline does not certify safety.
Malware removal, virus removal and quarantine
The malware cleaner helps remove malware through One click fix for eligible findings:
- Quarantine known malware and eligible suspicious files.
- Reinstall eligible core or official plugins at the installed version, backing up every affected file first.
- Verify repaired packages against official checksums, then rescan to review remaining findings.
Quarantine stores non-executable database copies, compressed when available, with one-click restore. Protected startup files and official core files cannot be quarantined. Uncertain findings stay under Needs your decision.
Hack cleanup and reinfection risks
After a hack, review the Reinfection risks tab. Neutralize can demote rogue administrators, remove suspicious scheduled events or quarantine planted files. Account roles and quarantined files can be restored; removed tasks cannot be restored through the plugin.
Optional vulnerability scanner
Enable the vulnerability scanner in Settings to compare installed core, plugin and theme versions against WPVulnerability records for known vulnerabilities. It is off by default and does not attempt exploits.
Scheduled malware scan and account options
- Daily or weekly scans: short batches, WP-Cron fallback, pause, resume and cancel.
- Local anti malware checks: scanning engines run on your server without an account; official verification contacts WordPress.org.
- Optional free account: 90,000+ known-malware signatures, hash lookups sending hashes only, downloaded signatures, a multi-site site security dashboard and alert emails. Enhanced analysis separately opts into sending suspicious code fragments.
- Dashboard: Simple and Advanced views, bulk actions, search, scan history and multisite support.
- AI agents and MCP: 20 abilities covering dashboard actions.
Screenshots
Malware Scan Overview: threat status, severity counts and safe cleanup actions.
Malware and Backdoor Findings: suspicious files, malicious code and evidence.
File Changes: created, modified, quarantined and repaired files.
Reinfection Risks: rogue admins, cron jobs, must-use plugins and drop-ins.
Malware Quarantine: restorable file copies.
Scan History: previous scans and threats.
Settings: account features, vulnerability check, limits and exclusions.
AI agents and MCP (WordPress Abilities API)
Since 1.2.0, hardened in 1.2.1, WordPress 6.9+ exposes 20 WordPress Abilities through the WordPress MCP Adapter. Claude, ChatGPT or Cursor can discover them to review infection status, preview fixes, mark false positives and schedule scans.
Abilities require administrator access, or network administrator on multisite. Changes to the site or threat visibility require confirm: true, prompting agent confirmation. Finding actions and quarantine deletion are annotated destructive. Output excludes absolute server paths, emails and secrets.
| Ability | What it does |
|---|---|
get-security-summary |
Verdict, score, severity counts, fixable/decision findings, reinfection, last scan, coverage, signatures, account |
get-fix-plan |
Proposed fixes, decisions and rescans with reasons |
get-findings |
Filters: severity, status, object_type, type, reinfection_only, search; paging and available actions |
get-finding-details |
Facts, redacted evidence and advice |
get-finding-diff |
Core/plugin differences from official copies |
get-scan-progress |
Status, stage, percent, files and rows |
get-scan-history |
Previous scans, counts and errors |
get-quarantine |
Copies; include_history includes restored/deleted records |
get-file-changes |
Created, modified, quarantined, restored and repaired files over 90 days |
get-event-log |
Events filtered by type |
get-settings |
Settings, account, signatures, next scan and view |
run-malware-scan |
Start background scan |
control-malware-scan |
Pause, resume, cancel |
fix-all |
Confirmed quarantine/official reinstall with backups; repeat batches while remaining > 0 |
finding-action |
quarantine, repair, trust, false_positive, ignore, acknowledge, reopen, neutralize; dashboard eligibility applies; six changing/hiding actions require confirmation; core repair-only; task removal includes arguments |
restore-quarantined |
Confirmed restore with hash/permission checks and rollback; repair backups overwrite reinstalled files |
delete-quarantined |
Confirmed permanent deletion; retry unfinished deletion, or remove restored/deleted records |
update-settings |
deep_scan_max_kb, batch_seconds, exclusions, schedule, vuln_intel, connected account features; immediate rescheduling; readback before updated: true; confirmation for reduced protection/cloud analysis |
set-view-mode |
Simple/Advanced for current user |
sync-signatures |
Start/force download on connected sites |
Install the MCP Adapter, create an administrator application password, then add the site to Claude Code:
Requirements
WordPress 6.0+, PHP 7.4+. Scanning engines run on your server; no account needed.
Installation
- In wp-admin, open Plugins > Add New, search DevDome Malware Scanner, install and activate.
- Open Malware Scanner > Scan Now. The first scan verifies integrity and seeds the baseline; later scans add the change timeline.
Part of the DevDome plugin family
Free plugins by DevDome: Analytics (cookieless, bot/AI crawler split, public API and MCP server), Malware Scanner, Redirect Manager, Media Cleaner, Link Monitor, Affiliate Manager. Each includes the DevDome Dashboard for one-click installation of the others.
Development
This repository mirrors WordPress.org releases. Open an issue for bugs or feature requests, or use the support forum.
License
GPL-2.0 or later. See LICENSE.
