Plugin Directory

Anti-Malware Security and Brute-Force Firewall

This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.


  • Fixed PHP Warning about in_array function expecting parameter 2 to be an array, found by Georgey B.
  • Made a few minor cosmetic changes and fixed a few other small bugs in the interface.


  • Fixed the Nonce Token error caused by W3 Total Cache breaking the set_transient function in WordPress.
  • Added the Brazilian Portuguese language files, thanks to Marcelo Guernieri for the translation.


  • Fixed the admin menu and also some links that did not work on Windows server.


  • Added Core Files to the Quick Scan list on the admin menu.
  • Added a nonce token to prevent Cross-Site Request Forgery by admins who are logged-in from another site.
  • Hardened against XSS vulnerability triggered by the file names being scanned (thanks to Mahadev Subedi).
  • Improved brute-force patch compatibility with alternate wp-config.php location.


  • Had to remove the encoding of the Default Definitions to meet the WordPress Plugin Guidelines.


  • Improved the JavaScript in the new Brute-Force login patch so that it works with caching enabled on the login page.


  • Improved the Brute-Force login patch with custom fields and JavaScript.
  • Added a Save button to that Scan Settings page.
  • Fixed a bug in the XMLRPC Patch "Unblock" feature.


  • Added a link to purge the deleted Quarantine items from the database.
  • Added firewall option to Block all XMLRPC calls.
  • Fixed a few cosmetic bugs in the quarantine and firewall options.


  • Fixed a bugs in the Quarantine that was memory_limit errors if there number of files in the was too high.
  • Added the highlight malicious code feature back to the Quarantine file viewer.
  • Added the ability to change the admin username if the current username is "admin".
  • Improved the code in the Brute-Force Protection patch.


  • Fixed a few bugs in the Core Files Check that was preventing it from fixing some unusual file modifications.


  • Fixed a major bug that made multisite scan extremely slow and sometimes error out.
  • Moved all ajax call out of the init function and into their own functions for better handling time.


  • Moved the quarantine files into the database and deleted the old directory in uploads.
  • Fixed some minor formatting issues in the HTML output on the settings page.
  • Added a warning message if base64_decode has been disabled.


  • Hardened against injected HTML content by encoding the tags with variables.
  • Fixed debug option to exclude individual definitions.


  • Hardened admin_init with current_user_can and realpath on the quarantine file deletion (thanks to J.D. Grimes).
  • Fixed another XSS vulnerabilities in the admin (thanks to James H.)


  • Hardened against XSS vulnerabilities in the admin (thanks to Tim Coen).
  • Added feature to restore default settings for Exclude Extensions.
  • Changed the encoding on the index.php file in the Quarantine to make it more human-readable.
  • Fixed a few small bugs that were throwing PHP Notices in some configurations and added more info to some error messages.


  • Extended execution_time during the Fix process to increase the number of files that could be fixed at a time.
  • Added a Quarantine log to the database.
  • Fixed a couple of minor bugs that would throw PHP notices.


  • Created an automatic update feature that downloads any new definition updates before starting the scan.
  • Added WordPress Core files to the new definitions update process and included a scan option to check the integrity of the Core files.
  • Automatically whitelisted the unmodified WordPress Core files.
  • Made more improvements to the Brute-Force protection patch and other minor cosmetic changes to the interface.
  • Protected the HTML in my plugin from filter injections and fixed a few other minor bugs.


  • Fixed a problem with deleting files from the Quarantine folder.
  • Added a descriptive reason to the error displayed if the fix was unsuccessful.
  • Added link to restore the default location of the Examine Results window.


  • Improved the encoding of definition updates so that they would not be blocked by poorly written firewall rules.
  • Suppressed the "Please make a donation" nag if the fix was unsuccessful, to avoid confusion over premium services.


  • Removed debug alert from initial session check.


  • Improved rewrite compatibility of session check for the Brute-Force Protection Installation.


  • Improved session check for the option to Install Brute-Force Protection and added an error message on failure.
  • Improved support for Multisite by only allowing Network Admins access to the Anti-Malware menu.


  • Added link to view a simple scan history on the Quarantine page.
  • Updated firewall to better protect agains new variations of the RevSlider Exploit.
  • Improved check for session support before giving the option to Install Brute-Force patch.


  • Added option to skip scanning the Quarantined files.
  • Updated Brute-Force patch to fix the problem of being included more that once.
  • Fixed a few minor bugs (better window positioning and css, cleaner results page, updated new help tab, etc.).
  • Made sure that the plugin does not check my servers for updates unless you have registered (this opt-in requirement is part of the WordPress Repository Guidelines).


  • Added exception for the social.png files to the skip files by extension list.
  • Fixed removal of Known Threats from files in the Quarantine directory.


  • Block SoakSoak and other malware from exploiting the Slider Revolution Vulnerability (THIS IS A WIDESPREAD THREAT RIGHT NOW).


  • Enabled the Brute-Force protection option directly from the Settings page.
  • Fixed window position to auto-adjust on small screens.


  • Major upgrade to the protection for wp-login.php Brute-Force attempts.
  • Fixes a bug in setting the permissions for read-only files so that they could still be cleaned.


  • Fixes a minor bug with pass-by-reference which raises a fatal error in PHP v5.4.


  • Enhanced the Examine File window with better styles and more info.
  • Changed form submission of encrypted file lists to array values instead of keys.
  • Fixes other minor bugs.


  • Made the Examine File window sizable.
  • Fixed a few small bugs and removed some old code.
  • Added a link to my new twitter account.


  • Re-purposed Quick Scan to just scan the most affected areas.
  • Set the registration form to display by defaulted in the definition update section.
  • Fixed a few small bugs in advanced features and directory depth determination.


  • Fixed a session bug to display the last directory scanned.
  • Fixed a few small cosmetic bugs for WP 3.8.


  • Added Spanish translation, thanks to Jelena Kovacevic and Andrew Kurtis at webhostinghub.com.


  • Updated string in the code and added a .pot file to be ready for translation into other languages.
  • Added "Select All" checkbox to Quarantine and a new button to delete items from the Quarantine.
  • Added a trace.php file for advanced session tracking.


  • Fixed undefined index bug with menu_group item in settings array.


  • Added support for multisite network admin menu and the ability to restrict admin access.


  • Fixed a session bug in the progress bar related to the last release.


  • Fixed a session bug that conflicted with jigoshop. (Thanks dragonflyfla)


  • Fixed a few bug in the Whitelist definition feature.


  • Added SSL support for definition updates and registration form.
  • Upgraded the Whitelist feature so the it could not contain duplicates.

  • Downgraded the WP-Login threat and changed it to an opt-in fix.

  • Fixed a bug in the Add to Whitelist feature so the you do not need to update the definitions after whitelisting a file.

  • Added ability to whitelist files.

  • Fixed a major bug in yesterdays release broke the login page on some sites.

  • Added a patch for the wp-login.php brute force attack that has been going around.
  • Created a process to restore files from the Quarantine.
  • Fixed a few other small bugs including path issues on Winblows server.

  • Improved security on the Quarantine directory to fix the 500 error on some servers.

  • Fixed count of Quarantined items.
  • Added htaccess security to the Uploads directory.

  • Fixed progress bar bug in the last release.
  • Linked the Quarantined items to the File Examiner.

  • Brought back the TimThumb and htaccess scan categories.
  • Added a scan category for Backdoor Scripts.

  • Fixed bugs in the last release.

  • Consolidated the Definition Types and added a Whitelist category.
  • Completely redesigned the Definition Updates to handle incremental updates.
  • Added "View Quarantine" to the menu.

  • Enhanced Output Buffer to work with compression enabled (like ob_gzhandler).
  • Moved the quarantine to the uploads directory to protect against blanket inclusion.

  • Fixed Output Buffer issue for when ob_start has already been called.

  • Enhanced the Automatic Fix process to handle bad directory permissions.
  • Added more detailed error messages for different types of file errors.
  • Fixed calculation for Time Remaining on the Progress Bar.

  • Re-calibrated the Progress Bar on the Quick Scan.
  • Improved overall error handling.
  • Minor UI enhancements and a few bug fixes.

  • Completely revamped the scan engine to handle large file systems with better error handling.
  • Enhanced the results for the Automatic Fix process.
  • Fixed a few other small bugs.

  • Enhanced the iFrame for the File Viewer and Automatic Fix process.
  • Improved error handling during the scan.
  • Fixed update checker script.

  • Fixed major bug in unregistered scan definition interpretation that causes many false positives.
  • Moved the File Viewer and Automatic Fix process into an iFrame to decrease scan time and memory usage.
  • Enhanced the Automatic Fix process for better success with read-only files.
  • Improved code cleanup process and general efficiency of the scan.

  • Encoded definition update for better compatibility with some servers that have post limitation.
  • Improved the code cleanup expression that is applied after removal of known threats.

  • Fixed return URL on Donate form.

  • Fixed XSS vulnerability.

  • Changed registration to allow for multiple sites/keys to be registered under one user/email.

  • Fixed "Invalid Threat level" Error on default values for pre-registration scans.
  • Changed auto-update path to update threat level array for all new definition updates.

  • Fixed auto-update script to update scan level even if there is no new definitions.

  • Added more info about registration to the readme file.
  • Updated timthumb replacement patch to version 2.8.10 per WordPress.org plugins requirement.
  • Fixed menu option placement to work just as well as a sub-menu under tools.

  • Fixed option to exclude directories so that the scan would not get stuck if omitted.
  • Added support for winblows servers using BACKSLASH directory structures.
  • Added option to exclude directories.
  • Changed definition updates to write to the DB instead of a file.
  • Added better messages about available updates.

  • Fixed registration form and some of the links on the settings page.

  • First BETA versions available for WordPress.

Requires: 3.3 or higher
Compatible up to: 4.3.1
Last Updated: 2 weeks ago
Active Installs: 100,000+


4.9 out of 5 stars


23 of 32 support threads in the last two months have been resolved.

Got something to say? Need help?


Not enough data

2 people say it works.
0 people say it's broken.

100,1,1 100,1,1 100,1,1 100,1,1
100,1,1 100,1,1 100,1,1
100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,2,2 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,2,2
100,2,2 100,3,3 100,2,2 100,4,4 100,1,1 100,1,1 100,1,1 100,2,2 100,1,1 100,1,1
100,2,2 100,1,1 100,1,1 100,1,1 100,2,2 100,1,1 100,1,1 100,1,1 100,1,1 100,3,3 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1
100,1,1 100,1,1 100,4,4 100,1,1 100,2,2 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,3,3 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1
100,3,3 100,1,1 100,1,1 100,4,4 100,5,5 100,2,2 100,1,1 100,2,2 100,5,5 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1
100,1,1 100,1,1 100,1,1 100,2,2 100,1,1 100,4,4 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1
100,2,2 100,10,10 100,2,2 100,7,7 100,1,1 100,2,2 100,6,6 100,6,6 100,2,2 100,1,1
100,7,7 100,3,3 100,4,4 100,3,3 100,1,1 100,1,1 100,1,1 100,1,1
100,1,1 100,10,10 100,3,3 100,1,1 100,1,1 100,1,1
100,9,9 100,1,1 100,1,1 100,1,1
100,2,2 100,1,1 100,1,1 100,1,1
100,4,4 100,6,6 100,1,1 100,1,1 100,1,1
100,1,1 100,1,1 100,4,4 100,1,1
100,6,6 100,7,7 100,16,16
100,2,2 100,1,1
80,5,4 100,1,1
100,2,2 100,4,4 100,2,2 100,1,1 100,1,1
100,1,1 100,6,6 100,1,1 100,4,4 100,3,3 100,1,1 100,1,1
100,1,1 100,4,4 100,1,1 100,5,5 100,6,6 100,7,7 100,1,1
100,8,8 100,1,1 100,4,4 100,5,5 100,7,7 100,2,2
100,2,2 100,2,2 100,1,1 100,1,1
100,1,1 100,2,2 100,1,1 100,1,1 100,1,1 100,1,1 100,1,1 100,2,2
100,1,1 100,1,1 100,2,2 100,1,1 100,1,1 100,7,7 100,2,2 100,2,2 100,5,5 100,5,5 100,6,6 100,1,1
100,9,9 100,1,1
67,3,2 100,4,4 100,9,9 100,4,4 100,2,2 100,2,2 100,2,2 100,2,2