Title: Moatline Malware Scanner Author: Next Nova Technologies Published: October 11, 2026 Last modified: October 11, 2026 --- Search plugins ![](https://ps.w.org/moatline-malware-scanner/assets/banner-772x250.png?rev=3739992) ![](https://ps.w.org/moatline-malware-scanner/assets/icon.svg?rev=3739992) # Moatline Malware Scanner By [Next Nova Technologies](https://profiles.wordpress.org/nextnova/) [Download](https://downloads.wordpress.org/plugin/moatline-malware-scanner.1.0.2.zip) * [Details](https://wordpress.org/plugins/moatline-malware-scanner/#description) * [Reviews](https://wordpress.org/plugins/moatline-malware-scanner/#reviews) * [Installation](https://wordpress.org/plugins/moatline-malware-scanner/#installation) * [Development](https://wordpress.org/plugins/moatline-malware-scanner/#developers) [Support](https://wordpress.org/support/plugin/moatline-malware-scanner/) ## Description Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake “verify you’re human” pop- ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database. #### Malware scanner * Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder. * Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells. * Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files. * Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages. * Results name the malware family that matched, so you know what you’re dealing with. #### Content scan Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead. * Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts. * Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains. * Ordinary scripts such as analytics or form embeds are not flagged. * Each finding links straight to the post or widget so you can remove the injected code. #### Integrity check against WordPress.org Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version. * Files identical to the official release are verified clean and skipped, which keeps false positives low. * Files that differ are flagged as modified. That is exactly where injected malware hides. #### Two-factor login * Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others. * Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it. * 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone. * Password logins over XML-RPC are refused for two-factor users, so the code screen can’t be bypassed. Apps use application passwords. #### XML-RPC protection * Three modes: allow, Jetpack-safe (only Jetpack’s signed requests are accepted) or block completely. * Refuse password logins over XML-RPC and disable `system.multicall`, which attackers use to try hundreds of passwords in one request. * Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you. * Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy. #### Login protection and access * Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist. * Hide usernames from the REST API and block `?author=` username scans. * See every active login session with IP address and browser, including sessions left by deleted users. * One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php. * Audit and revoke application passwords, or turn them off. Every option that blocks something is off until you turn it on, and each one explains what it might affect. #### Live monitoring * Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API). * Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs. #### Lockdown * One-click file modification lock (`DISALLOW_FILE_EDIT` / `DISALLOW_FILE_MODS`) so attackers can’t install or edit plugins and themes through the dashboard. * Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided). #### Login security * Move the login page to a custom URL and hide wp-login.php. * Send bots probing the default login page to a 404. #### Database cron cleaner * Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click “Clean DB Now”. #### Activity log * Records security-relevant events such as suspicious cron registrations, with export to JSON. #### Security score * A dashboard score and checklist that shows what to fix next. #### Pro add-on The free plugin finds and reports threats. The [Pro add-on](https://moatline.io/pro) is a separate, optional plugin for people who want them fixed automatically: one- click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above. #### Links * [Website](https://moatline.io) * [Documentation](https://moatline.io/docs) * [Support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/) ### External services This plugin connects to WordPress.org to verify plugin files. **WordPress.org plugin checksums** (`https://downloads.wordpress.org/plugin-checksums/`) * What it’s used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged. * What is sent: the slug and version number of each installed plugin (for example` contact-form-7` and `5.9`), when you run a scan. No personal data, site content or file contents are sent. * Provided by WordPress.org: [Terms of Service](https://wordpress.org/about/terms-of-service/) and [Privacy Policy](https://wordpress.org/about/privacy/). If your server cannot reach WordPress.org, the scan continues without the integrity check. ### Credits QR codes for two-factor login are drawn with [qrcode-generator](https://www.npmjs.com/package/qrcode-generator) by Kazuhiko Arase (MIT licence), bundled in `assets/js/vendor/qrcode.js`. ## Screenshots [⌊Dashboard with security score, status tiles and checklist.⌉⌊Dashboard with security score, status tiles and checklist.⌉[ Dashboard with security score, status tiles and checklist. [⌊Malware scanner results, naming the malware family for each finding.⌉⌊Malware scanner results, naming the malware family for each finding.⌉[ Malware scanner results, naming the malware family for each finding. [⌊Lockdown: file modification lock and PHP blocking in uploads.⌉⌊Lockdown: file modification lock and PHP blocking in uploads.⌉[ Lockdown: file modification lock and PHP blocking in uploads. [⌊Login security: a custom login URL that hides wp-login.php and wp-admin.⌉⌊Login security: a custom login URL that hides wp-login.php and wp-admin.⌉[ Login security: a custom login URL that hides wp-login.php and wp-admin. [⌊Activity log.⌉⌊Activity log.⌉[ Activity log. [⌊Hardening & Access: XML-RPC protection, username hiding, login limits and application passwords.⌉⌊Hardening & Access: XML-RPC protection, username hiding, login limits and application passwords.⌉[ Hardening & Access: XML-RPC protection, username hiding, login limits and application passwords. ## Installation 1. In your dashboard go to Plugins Add New and search for “Moatline Malware Scanner”, or upload the `moatline-malware-scanner` folder to `/wp-content/plugins/`. 2. Activate the plugin. 3. Open Malware Scanner Scanner and run your first scan. 4. Work through the checklist on the Malware Scanner Dashboard page (Lockdown, Login Security, Settings). ## FAQ ### Will the scanner delete anything automatically? No. The free plugin never deletes or changes files on its own. Scans only report findings. The database cleaner runs only when you click “Clean DB Now”. ### What happens when a file is flagged? You can review it, dismiss it, or exclude the path in Settings. Files that belong to WordPress.org plugins can be fixed by reinstalling that plugin. The Pro add-on adds one-click removal and restore. ### I lost my phone and can’t log in. What do I do? Use one of your backup codes. If you don’t have them, another administrator can reset your two-factor login from your user profile. As a last resort, add `define(' NNMS_DISABLE_2FA', true );` to wp-config.php, log in, and remove the line again. ### Will blocking XML-RPC break Jetpack or the mobile app? All XML-RPC options are off by default. If you use Jetpack, choose Jetpack-safe mode: Jetpack keeps working while password logins and multicall stay blocked. The WordPress mobile app can sign in with an application password. ### Can I use it alongside another security plugin? Yes. Moatline Malware Scanner does not run a firewall that conflicts with other security plugins. Run one malware scanner at a time if your hosting has limited resources. ### I set a custom login URL and I’m locked out. What do I do? Rename the `wp-content/plugins/moatline-malware-scanner` folder over FTP or your host’s file manager. This disables the plugin and restores the normal login page. ### Does it work on Nginx? Yes. Everything works on Nginx. For blocking PHP in uploads, the plugin shows the Nginx rule to add to your server configuration, because Nginx doesn’t read .htaccess files. ### Does the plugin send any data off my site? Only to check plugin files against WordPress.org, as described under “External services” below. No personal data is sent and there is no tracking. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Moatline Malware Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ Next Nova Technologies ](https://profiles.wordpress.org/nextnova/) * [ ibrahimshah2144 ](https://profiles.wordpress.org/ibrahimshah2144/) [Translate “Moatline Malware Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/moatline-malware-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/moatline-malware-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/moatline-malware-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/moatline-malware-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/moatline-malware-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * New: detects the fake “WordPress Defender”, “WordPress Security” and “White Label” plugins found on hacked sites in 2026, plus plugins whose author is just “WordPress”. * New: flags empty plugin files left behind by host malware cleaners, which can crash a site. * New: detects malware plugins that hide themselves from the Plugins list. * New: signatures for the mlroweb, latoem and renotad script injections. * New: Settings, Docs and Support links on the Plugins screen. * Changed: links now point to the new home of the plugin, moatline.io. #### 1.0.1 * Fixed: “Clean DB Now” stayed on “Cleaning…” and never finished. * Fixed: signing in from a custom login URL sent you back to the login page. * Changed: with a custom login URL, logged-out visitors to /wp-login.php and /wp- admin now see “page not found” instead of being sent to the new address. * Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately. * New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours. * Changed: deleting the plugin keeps settings and two-step login setups unless you choose “Delete all plugin data” in Settings. #### 1.0.0 * Initial release. ## Meta * Version **1.0.2** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.0 or higher ** * Tags * [hardening](https://wordpress.org/plugins/tags/hardening/)[login security](https://wordpress.org/plugins/tags/login-security/) [malware scanner](https://wordpress.org/plugins/tags/malware-scanner/)[security](https://wordpress.org/plugins/tags/security/) [two factor](https://wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://wordpress.org/plugins/moatline-malware-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/moatline-malware-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/moatline-malware-scanner/reviews/) ## Contributors * [ Next Nova Technologies ](https://profiles.wordpress.org/nextnova/) * [ ibrahimshah2144 ](https://profiles.wordpress.org/ibrahimshah2144/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/)