What a malware scan actually checks - and what it misses

You run a scan, it says everything looks clean, and you breathe out a little. Fair enough. That’s how these tools are supposed to feel.

But here’s the awkward bit: a malware scan is helpful, not magical. It can catch plenty of nasty stuff, sure, but it also misses things all the time. Especially on small business WordPress sites where the setup is a weird mix of old plugins, page builders, custom snippets, and a theme somebody touched three years ago then vanished.

So let’s make this simple. What does a malware scan actually check? And what does it completely fail to see?

What a malware scan is usually looking for

Most WordPress malware scanners compare your site files and database content against things already known to be bad. Think of it like airport security looking for items on a list. If the scanner has seen a particular malware pattern before, there’s a decent chance it’ll flag it.

That usually includes:

• Known malicious code patterns in PHP, JavaScript, or obfuscated text
• Suspicious functions like eval(), base64_decode(), gzinflate(), and long unreadable strings
• Files that shouldn’t be there, like a random wp-login-old.php or fake plugin folder
• Changed core WordPress files that no longer match official checksums
• Spam links, hidden redirects, injected SEO pages, and database junk

That’s useful. Very useful, actually. If your site has picked up a cheap casino redirect, a backdoor dropped into /wp-content/uploads/, or a known malware family that’s been making the rounds for months, a decent scanner can spot it fast.

If you’re using a dedicated malware scanner, this is the kind of stuff it should be checking every day without you having to poke around in files manually. Honestly, most owners should never have to open File Manager and go hunting for weird PHP files on their own.

What it catches well

Let’s give scanners some credit. They do catch a lot of the boring, common rubbish that hits WordPress sites.

For example, say a florist’s website gets hit through an old form plugin. The attacker uploads a script into the uploads folder and starts injecting spam pages about pills and crypto nonsense. A scanner may detect the new file, the obfuscated code, and the database junk. Great. That’s exactly where these tools earn their keep.

They’re also pretty handy for checking file integrity. If core WordPress files were modified, maybe wp-settings.php or something inside wp-includes, a scanner can compare them against clean originals and raise a flag. That’s often faster than waiting for your host to send that dreaded “we detected malware” email after Google already noticed. We wrote about that problem here: Why your hosting’s “malware detected” email often arrives too late.

And yes, scanners are good for routine checks. Quiet, repeatable, boring checks. Which is exactly what security should be alot of the time.

What a malware scan misses all the time

This is the part people don’t love hearing.

A scanner can tell you whether it found known signs of malware. It cannot promise your site is safe. Those are very different statements.

Here are the big blind spots.

1. Brand new malware

If the malicious code is fresh, custom, or just slightly rewritten, signature-based scanning may miss it completely. Attackers know scanners exist. They’re not sitting there kindly uploading obvious files called hacker-shell.php. They rename things. Split code into pieces. Hide payloads inside normal-looking plugin files.

So the scan comes back clean. Meanwhile, the attacker still has a foothold.

2. Stolen admin access

If somebody logs in with a real admin account, a malware scanner may see nothing weird at all.

Think about that for a second. If an attacker gets in using a reused password, buys access from another breach, or slips through because there was no 2FA, they can create a new admin user, install a plugin, export customer data, or quietly change settings. No malware required.

That’s why login security matters just as much as scanning. If you haven’t locked that down yet, adding two-factor authentication is one of the easiest wins you can get.

3. Malicious behavior that looks normal

Some attacks don’t plant obvious malware. They abuse built-in features.

A contact form gets used for spam. A file manager plugin becomes a doorway. A compromised admin account adds hidden users. A scheduler task runs every night and reinserts junk after cleanup. The code might look legitimate enough that a scanner shrugs and moves on.

This is where people get fooled by green checkmarks. We covered that trap in The “install Wordfence and forget it” trap. A scanner is a tool, not a substitute for paying attention.

4. Infected backups or staging copies

Your live site might scan clean today. Nice. But what about the backup from two weeks ago? Or the staging site on a subdomain nobody remembers? Or that old dev copy still sitting in a folder like /newsite/?

I’ve seen this kill a site. The live version gets cleaned, then someone restores an infected backup later and the whole mess starts again.

5. Server-level problems

Most WordPress malware scanners work inside WordPress. Which means they can only see so much.

If the issue lives outside your WordPress install - in another site on the same hosting account, a dodgy cron job, a poisoned .htaccess file above the web root, or a compromised hosting account - the plugin scanner may miss the real source. That’s not the scanner being stupid. It’s just stuck inside its lane.

So what should you actually do with scan results?

Don’t treat them like a pass or fail grade. Treat them like one input.

If the scan finds malware, act fast. If it finds nothing, don’t assume you’re invincible. Look at the bigger picture:

1. Are WordPress core, plugins, and themes updated?
2. Are you still using abandoned plugins or themes?
3. Do all admin users still need access?
4. Is 2FA enabled?
5. Do you know what changed on the site this week?
6. Do you have clean backups you can actually restore?

That’s the stuff that seperates a site that’s merely scanned from a site that’s actually looked after.

A clean scan doesn’t mean “do nothing”

This is where small business owners get stuck. They think security starts with malware and ends with malware. Nope.

Good website care is mostly maintenance. Boring updates. Removing junk plugins. Checking who has admin access. Making sure backups work. Watching for changes before they become disasters. Very glamorous, I know.

If you don’t want to keep track of all that yourself, that’s exactly what a proper WordPress maintenance setup is for. Not just cleaning up after fires. Preventing them, spotting warning signs early, and keeping your site from becoming that Friday-night emergency nobody wanted.

When a malware scan is enough - and when it isn’t

If you’ve got a small brochure site, very few plugins, no custom code, and no weird symptoms, regular scanning is a solid start. Totally reasonable.

But if your site is acting odd - redirects, spam pages, missing emails, strange admin users, checkout problems, search warnings, random file changes - a clean malware scan is not the end of the story. It’s barely the start. At that point you need actual investigation, not just another button click - a proper hacked WordPress site cleanup.

Because the question isn’t only “is there malware?”

It’s “how did this happen, what else changed, and will it come back next week?”

That’s the part scanners often miss. And honestly, that’s the part that matters most.