WordPress Malware Scanner

SSHes into your hosting account, scans every WordPress install for the known indicators of the 2026 JavaScript-injection / Traffic-Direction-System malware — fake "cache/performance" plugins, an obfuscated C2 loader appended to theme JS, rogue admin accounts — then checks the PUBLIC CDN delivery path, because a cleaned origin can still serve infected files from a stale cache for hours. Scans and reports only; it never touches the server unless you explicitly tell it to remediate.

• Detects by file CONTENT, not timestamp — the attacker resets mtimes to defeat "recently modified" scans
• Carries the real-world IOCs: C2 domains, obfuscated-loader signatures, and self-hiding-plugin tells
• Checks both the origin (SSH) and the public CDN path, where stale infected files linger
• Read-only by default — remediation only on explicit instruction, with backups + re-verification