Moatline Malware Scanner

Description

Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake “verify you’re human” pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.

Malware scanner

• Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.
• Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.
• Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.
• Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.
• Results name the malware family that matched, so you know what you’re dealing with.

Content scan

Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.

• Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.
• Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.
• Ordinary scripts such as analytics or form embeds are not flagged.
• Each finding links straight to the post or widget so you can remove the injected code.

Integrity check against WordPress.org

Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.

• Files identical to the official release are verified clean and skipped, which keeps false positives low.
• Files that differ are flagged as modified. That is exactly where injected malware hides.

Two-factor login

• Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.
• Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.
• 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.
• Password logins over XML-RPC are refused for two-factor users, so the code screen can’t be bypassed. Apps use application passwords.

XML-RPC protection

• Three modes: allow, Jetpack-safe (only Jetpack’s signed requests are accepted) or block completely.
• Refuse password logins over XML-RPC and disable system.multicall, which attackers use to try hundreds of passwords in one request.
• Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.
• Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.

Login protection and access

• Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.
• Hide usernames from the REST API and block ?author= username scans.
• See every active login session with IP address and browser, including sessions left by deleted users.
• One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.
• Audit and revoke application passwords, or turn them off.

Every option that blocks something is off until you turn it on, and each one explains what it might affect.

Live monitoring

• Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).
• Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.

Lockdown

• One-click file modification lock (DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS) so attackers can’t install or edit plugins and themes through the dashboard.
• Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).

Login security

• Move the login page to a custom URL and hide wp-login.php.
• Send bots probing the default login page to a 404.

Database cron cleaner

• Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click “Clean DB Now”.

Activity log

• Records security-relevant events such as suspicious cron registrations, with export to JSON.

Security score

• A dashboard score and checklist that shows what to fix next.

Pro add-on

The free plugin finds and reports threats. The Pro add-on is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above.

Links

• Website
• Documentation
• Support forum

External services

This plugin connects to WordPress.org to verify plugin files.

WordPress.org plugin checksums (https://downloads.wordpress.org/plugin-checksums/)

• What it’s used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.
• What is sent: the slug and version number of each installed plugin (for example contact-form-7 and 5.9), when you run a scan. No personal data, site content or file contents are sent.
• Provided by WordPress.org: Terms of Service and Privacy Policy.

If your server cannot reach WordPress.org, the scan continues without the integrity check.

Credits

QR codes for two-factor login are drawn with qrcode-generator by Kazuhiko Arase (MIT licence), bundled in assets/js/vendor/qrcode.js.