{"id":380697,"date":"2026-10-11T18:51:18","date_gmt":"2026-10-11T18:51:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/n-security\/"},"modified":"2026-10-11T20:45:08","modified_gmt":"2026-10-11T20:45:08","slug":"moatline-malware-scanner","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/moatline-malware-scanner\/","author":23580937,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.2","stable_tag":"1.0.2","tested":"7.1.3","requires":"5.0","requires_php":"7.0","requires_plugins":null,"header_name":"Moatline Malware Scanner","header_author":"Next Nova Technologies","header_description":"Malware scanner with WordPress.org integrity checks, file lockdown, login hardening, database cron cleaner and activity log.","assets_banners_color":"14223d","last_updated":"2026-10-11 20:45:08","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/moatline.io","header_author_uri":"https:\/\/nextnova.tech","rating":0,"author_block_rating":0,"active_installs":0,"downloads":44,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.1":{"tag":"1.0.1","author":"n2securityio","date":"2026-10-11 18:51:07","revision":3739980},"1.0.2":{"tag":"1.0.2","author":"n2securityio","date":"2026-10-11 20:45:08","revision":3740107}},"upgrade_notice":{"1.0.2":"<p>Detects new fake security plugins and malware injections seen on hacked sites this month.<\/p>","1.0.1":"<p>Fixes the database cleaner and custom login URL, and adds Pause, Resume and Stop for scans.<\/p>","1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3739992,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3739992,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3739992,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3739992,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3739992,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3739992,"resolution":"1","location":"assets","locale":"","width":1530,"height":1620},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3739992,"resolution":"2","location":"assets","locale":"","width":1530,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3739992,"resolution":"3","location":"assets","locale":"","width":1530,"height":1620},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3739992,"resolution":"4","location":"assets","locale":"","width":1530,"height":1208},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3739992,"resolution":"5","location":"assets","locale":"","width":1530,"height":630},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3739992,"resolution":"6","location":"assets","locale":"","width":1530,"height":1845}},"screenshots":{"1":"Dashboard with security score, status tiles and checklist.","2":"Malware scanner results, naming the malware family for each finding.","3":"Lockdown: file modification lock and PHP blocking in uploads.","4":"Login security: a custom login URL that hides wp-login.php and wp-admin.","5":"Activity log.","6":"Hardening &amp; Access: XML-RPC protection, username hiding, login limits and application passwords."}},"plugin_section":[],"plugin_tags":[31093,1229,55021,600,9217],"plugin_category":[54],"plugin_contributors":[285890,285889],"plugin_business_model":[],"class_list":["post-380697","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-login-security","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-ibrahimshah2144","plugin_contributors-nextnova","plugin_committers-n2securityio","plugin_committers-nextnova"],"banners":{"banner":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/banner-772x250.png?rev=3739992","banner_2x":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/banner-1544x500.png?rev=3739992","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/icon.svg?rev=3739992","icon":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/icon.svg?rev=3739992","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-1.png?rev=3739992","caption":"Dashboard with security score, status tiles and checklist."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-2.png?rev=3739992","caption":"Malware scanner results, naming the malware family for each finding."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-3.png?rev=3739992","caption":"Lockdown: file modification lock and PHP blocking in uploads."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-4.png?rev=3739992","caption":"Login security: a custom login URL that hides wp-login.php and wp-admin."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-5.png?rev=3739992","caption":"Activity log."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-6.png?rev=3739992","caption":"Hardening &amp; Access: XML-RPC protection, username hiding, login limits and application passwords."}],"raw_content":"<!--section=description-->\n<p>Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake \"verify you're human\" pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.<\/p>\n\n<h4>Malware scanner<\/h4>\n\n<ul>\n<li>Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder.<\/li>\n<li>Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells.<\/li>\n<li>Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files.<\/li>\n<li>Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages.<\/li>\n<li>Results name the malware family that matched, so you know what you're dealing with.<\/li>\n<\/ul>\n\n<h4>Content scan<\/h4>\n\n<p>Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.<\/p>\n\n<ul>\n<li>Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts.<\/li>\n<li>Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains.<\/li>\n<li>Ordinary scripts such as analytics or form embeds are not flagged.<\/li>\n<li>Each finding links straight to the post or widget so you can remove the injected code.<\/li>\n<\/ul>\n\n<h4>Integrity check against WordPress.org<\/h4>\n\n<p>Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.<\/p>\n\n<ul>\n<li>Files identical to the official release are verified clean and skipped, which keeps false positives low.<\/li>\n<li>Files that differ are flagged as modified. That is exactly where injected malware hides.<\/li>\n<\/ul>\n\n<h4>Two-factor login<\/h4>\n\n<ul>\n<li>Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.<\/li>\n<li>Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it.<\/li>\n<li>10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone.<\/li>\n<li>Password logins over XML-RPC are refused for two-factor users, so the code screen can't be bypassed. Apps use application passwords.<\/li>\n<\/ul>\n\n<h4>XML-RPC protection<\/h4>\n\n<ul>\n<li>Three modes: allow, Jetpack-safe (only Jetpack's signed requests are accepted) or block completely.<\/li>\n<li>Refuse password logins over XML-RPC and disable <code>system.multicall<\/code>, which attackers use to try hundreds of passwords in one request.<\/li>\n<li>Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.<\/li>\n<li>Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.<\/li>\n<\/ul>\n\n<h4>Login protection and access<\/h4>\n\n<ul>\n<li>Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.<\/li>\n<li>Hide usernames from the REST API and block <code>?author=<\/code> username scans.<\/li>\n<li>See every active login session with IP address and browser, including sessions left by deleted users.<\/li>\n<li>One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.<\/li>\n<li>Audit and revoke application passwords, or turn them off.<\/li>\n<\/ul>\n\n<p>Every option that blocks something is off until you turn it on, and each one explains what it might affect.<\/p>\n\n<h4>Live monitoring<\/h4>\n\n<ul>\n<li>Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).<\/li>\n<li>Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.<\/li>\n<\/ul>\n\n<h4>Lockdown<\/h4>\n\n<ul>\n<li>One-click file modification lock (<code>DISALLOW_FILE_EDIT<\/code> \/ <code>DISALLOW_FILE_MODS<\/code>) so attackers can't install or edit plugins and themes through the dashboard.<\/li>\n<li>Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).<\/li>\n<\/ul>\n\n<h4>Login security<\/h4>\n\n<ul>\n<li>Move the login page to a custom URL and hide wp-login.php.<\/li>\n<li>Send bots probing the default login page to a 404.<\/li>\n<\/ul>\n\n<h4>Database cron cleaner<\/h4>\n\n<ul>\n<li>Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click \"Clean DB Now\".<\/li>\n<\/ul>\n\n<h4>Activity log<\/h4>\n\n<ul>\n<li>Records security-relevant events such as suspicious cron registrations, with export to JSON.<\/li>\n<\/ul>\n\n<h4>Security score<\/h4>\n\n<ul>\n<li>A dashboard score and checklist that shows what to fix next.<\/li>\n<\/ul>\n\n<h4>Pro add-on<\/h4>\n\n<p>The free plugin finds and reports threats. The <a href=\"https:\/\/moatline.io\/pro\">Pro add-on<\/a> is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above.<\/p>\n\n<h4>Links<\/h4>\n\n<ul>\n<li><a href=\"https:\/\/moatline.io\">Website<\/a><\/li>\n<li><a href=\"https:\/\/moatline.io\/docs\">Documentation<\/a><\/li>\n<li><a href=\"https:\/\/wordpress.org\/support\/plugin\/moatline-malware-scanner\/\">Support forum<\/a><\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to WordPress.org to verify plugin files.<\/p>\n\n<p><strong>WordPress.org plugin checksums<\/strong> (<code>https:\/\/downloads.wordpress.org\/plugin-checksums\/<\/code>)<\/p>\n\n<ul>\n<li>What it's used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.<\/li>\n<li>What is sent: the slug and version number of each installed plugin (for example <code>contact-form-7<\/code> and <code>5.9<\/code>), when you run a scan. No personal data, site content or file contents are sent.<\/li>\n<li>Provided by WordPress.org: <a href=\"https:\/\/wordpress.org\/about\/terms-of-service\/\">Terms of Service<\/a> and <a href=\"https:\/\/wordpress.org\/about\/privacy\/\">Privacy Policy<\/a>.<\/li>\n<\/ul>\n\n<p>If your server cannot reach WordPress.org, the scan continues without the integrity check.<\/p>\n\n<h3>Credits<\/h3>\n\n<p>QR codes for two-factor login are drawn with <a href=\"https:\/\/www.npmjs.com\/package\/qrcode-generator\">qrcode-generator<\/a> by Kazuhiko Arase (MIT licence), bundled in <code>assets\/js\/vendor\/qrcode.js<\/code>.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>In your dashboard go to Plugins \u2192 Add New and search for \"Moatline Malware Scanner\", or upload the <code>moatline-malware-scanner<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin.<\/li>\n<li>Open Malware Scanner \u2192 Scanner and run your first scan.<\/li>\n<li>Work through the checklist on the Malware Scanner \u2192 Dashboard page (Lockdown, Login Security, Settings).<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20the%20scanner%20delete%20anything%20automatically%3F\"><h3>Will the scanner delete anything automatically?<\/h3><\/dt>\n<dd><p>No. The free plugin never deletes or changes files on its own. Scans only report findings. The database cleaner runs only when you click \"Clean DB Now\".<\/p><\/dd>\n<dt id=\"what%20happens%20when%20a%20file%20is%20flagged%3F\"><h3>What happens when a file is flagged?<\/h3><\/dt>\n<dd><p>You can review it, dismiss it, or exclude the path in Settings. Files that belong to WordPress.org plugins can be fixed by reinstalling that plugin. The Pro add-on adds one-click removal and restore.<\/p><\/dd>\n<dt id=\"i%20lost%20my%20phone%20and%20can%27t%20log%20in.%20what%20do%20i%20do%3F\"><h3>I lost my phone and can't log in. What do I do?<\/h3><\/dt>\n<dd><p>Use one of your backup codes. If you don't have them, another administrator can reset your two-factor login from your user profile. As a last resort, add <code>define( 'NNMS_DISABLE_2FA', true );<\/code> to wp-config.php, log in, and remove the line again.<\/p><\/dd>\n<dt id=\"will%20blocking%20xml-rpc%20break%20jetpack%20or%20the%20mobile%20app%3F\"><h3>Will blocking XML-RPC break Jetpack or the mobile app?<\/h3><\/dt>\n<dd><p>All XML-RPC options are off by default. If you use Jetpack, choose Jetpack-safe mode: Jetpack keeps working while password logins and multicall stay blocked. The WordPress mobile app can sign in with an application password.<\/p><\/dd>\n<dt id=\"can%20i%20use%20it%20alongside%20another%20security%20plugin%3F\"><h3>Can I use it alongside another security plugin?<\/h3><\/dt>\n<dd><p>Yes. Moatline Malware Scanner does not run a firewall that conflicts with other security plugins. Run one malware scanner at a time if your hosting has limited resources.<\/p><\/dd>\n<dt id=\"i%20set%20a%20custom%20login%20url%20and%20i%27m%20locked%20out.%20what%20do%20i%20do%3F\"><h3>I set a custom login URL and I'm locked out. What do I do?<\/h3><\/dt>\n<dd><p>Rename the <code>wp-content\/plugins\/moatline-malware-scanner<\/code> folder over FTP or your host's file manager. This disables the plugin and restores the normal login page.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20nginx%3F\"><h3>Does it work on Nginx?<\/h3><\/dt>\n<dd><p>Yes. Everything works on Nginx. For blocking PHP in uploads, the plugin shows the Nginx rule to add to your server configuration, because Nginx doesn't read .htaccess files.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20send%20any%20data%20off%20my%20site%3F\"><h3>Does the plugin send any data off my site?<\/h3><\/dt>\n<dd><p>Only to check plugin files against WordPress.org, as described under \"External services\" below. No personal data is sent and there is no tracking.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>New: detects the fake \"WordPress Defender\", \"WordPress Security\" and \"White Label\" plugins found on hacked sites in 2026, plus plugins whose author is just \"WordPress\".<\/li>\n<li>New: flags empty plugin files left behind by host malware cleaners, which can crash a site.<\/li>\n<li>New: detects malware plugins that hide themselves from the Plugins list.<\/li>\n<li>New: signatures for the mlroweb, latoem and renotad script injections.<\/li>\n<li>New: Settings, Docs and Support links on the Plugins screen.<\/li>\n<li>Changed: links now point to the new home of the plugin, moatline.io.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed: \"Clean DB Now\" stayed on \"Cleaning...\" and never finished.<\/li>\n<li>Fixed: signing in from a custom login URL sent you back to the login page.<\/li>\n<li>Changed: with a custom login URL, logged-out visitors to \/wp-login.php and \/wp-admin now see \"page not found\" instead of being sent to the new address.<\/li>\n<li>Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately.<\/li>\n<li>New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours.<\/li>\n<li>Changed: deleting the plugin keeps settings and two-step login setups unless you choose \"Delete all plugin data\" in Settings.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Malware scanner, two-factor login, XML-RPC protection and hardening, with WordPress.org integrity checks and an activity log.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/380697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=380697"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/nextnova"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=380697"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=380697"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=380697"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=380697"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=380697"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=380697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}