Why MalCare Scan Issues Happen
If you are trying to figure out how to fix MalCare scan not working, the cause is usually something simple: a connectivity problem, a WordPress configuration issue, or a conflict on the server.
The good news is that MalCare scan failures are often diagnosable with a few targeted checks.
MalCare is a WordPress security plugin that uses cloud-based malware detection, so its scan process depends on your site, hosting environment, and external communication working together correctly.
What the MalCare scan depends on
Before troubleshooting, it helps to understand the moving parts involved in a scan.
MalCare typically relies on:
- A working WordPress installation with access to the admin area
- The MalCare plugin being active and up to date
- Server connectivity that allows outbound requests
- PHP, memory, and execution limits that can support background tasks
- Compatibility with security tools, caching layers, and firewall rules
When any of these fail, the scan may stall, never start, or return an error message.
Common reasons MalCare scan is not working
Plugin connection problems
MalCare must connect to its service to initiate scans and fetch results.
If the plugin is disconnected, outdated, or blocked by a temporary authentication issue, scanning can stop immediately.
Server or hosting restrictions
Some hosts restrict outgoing connections, background processing, or loopback requests.
Managed WordPress hosting, in particular, may apply limits that interfere with security plugins.
Firewall or security plugin conflicts
Wordfence, Sucuri, iThemes Security, server-side firewalls, or a web application firewall such as Cloudflare may block requests that MalCare needs to complete a scan.
Low PHP resources
If your site has low PHP memory, short max execution time, or unstable cron behavior, the scan may time out or fail during initialization.
Corrupted plugin or WordPress files
Incomplete updates, file permission problems, or corrupted WordPress core files can prevent MalCare from reading the site correctly.
How to fix MalCare scan not working step by step
1. Confirm that MalCare is active and connected
Start by opening the MalCare dashboard in WordPress and checking whether the plugin shows as connected.
If it is disconnected, reconnect the site from the MalCare account area and refresh the dashboard.
If the plugin appears active but unresponsive, deactivate and reactivate it carefully, then try the scan again.
This can reset a temporary service connection issue.
2. Update WordPress, MalCare, and related plugins
Make sure WordPress core, the MalCare plugin, and any security or caching plugins are current.
Compatibility issues are more common on older versions, especially when PHP versions have changed on the server.
Updating also helps because MalCare regularly improves detection logic and cloud communication behavior.
3. Check whether another security tool is blocking MalCare
Temporarily disable other security plugins and any active firewall rules, then test the scan again.
If you use Cloudflare, review firewall events, bot protections, and rate limiting that may affect your WordPress admin or Ajax requests.
If the scan works after disabling a tool, add a whitelist or exception for MalCare rather than leaving the protection turned off.
4. Test your hosting environment
Ask your host whether outbound requests, loopback connections, or background jobs are restricted.
MalCare scans may fail if the host blocks communication with the plugin’s service endpoints.
You can also ask support to confirm that no server-level ModSecurity rule, malware scanner, or rate limiter is interfering with WordPress admin requests.
5. Increase PHP memory and execution limits
Low PHP limits can cause scan jobs to fail before they finish.
Typical signs include timeouts, stalled scans, or repeated attempts that never complete.
- Increase PHP memory limit if your host allows it
- Raise max execution time for WordPress requests
- Ensure PHP workers are not saturated during busy traffic periods
If you are not comfortable editing configuration files, ask your hosting provider to increase these limits for you.
6. Verify WordPress cron is functioning
Many WordPress tasks rely on WP-Cron, including plugin actions that run in the background.
If WP-Cron is disabled or broken, scheduled scan-related tasks may not start properly.
Use a plugin or hosting panel to check whether cron events are running.
If needed, fix traffic-based cron triggering or replace it with a real server cron job.
7. Inspect file permissions and ownership
MalCare needs access to read WordPress files.
Incorrect file permissions or mismatched ownership can cause the plugin to fail when it tries to inspect the site.
Typical WordPress file access should allow the web server to read core, plugin, and theme files.
If permissions look unusual, have your host review them safely.
8. Clear cache and retest
Cached admin pages, browser cache, and proxy caches can sometimes show stale plugin states.
Clear your browser cache, purge site cache, and then reopen the MalCare dashboard to retest the scan.
If you use a CDN, purge it as well so old responses do not interfere with troubleshooting.
How to narrow down the cause faster
If you want a faster path to the root cause, isolate variables one at a time.
Change only one setting, test the scan, and note whether the behavior improves.
- Try the scan from a different browser or device
- Switch off other plugins temporarily, one category at a time
- Test with a default WordPress theme if theme-level code is suspected
- Check whether the problem occurs for all admin users or only one account
This approach helps you determine whether the issue is local, plugin-related, host-related, or network-related.
When the issue points to your host
If MalCare still does not scan after plugin updates, cache clearing, and conflict checks, the hosting environment is likely involved.
That is especially true when scans fail consistently on one server but work on another site using the same plugin.
Useful questions for support include:
- Are outbound HTTP or HTTPS requests restricted?
- Are loopback requests blocked?
- Is there a ModSecurity rule affecting WordPress admin calls?
- Are PHP memory and execution limits unusually low?
- Is the server experiencing resource exhaustion or high load?
Best practices to prevent future MalCare scan failures
Once the scan works again, a few maintenance habits can reduce repeat failures.
Keep WordPress and plugins updated, minimize overlapping security tools, and monitor hosting resource usage.
- Review plugin compatibility before installing new security or caching tools
- Use a quality host with clear support for WordPress background tasks
- Keep PHP on a supported version
- Watch for plugin disconnects after migrations or domain changes
- Test scans after major updates or firewall changes
It also helps to document the exact time the failure started and what changed shortly before it.
That record can save time if you need to escalate the issue to MalCare support or your hosting provider.
What to send to support if MalCare scan still fails
If you have already tried the main fixes and the scan is still not working, provide support with specific details so they can diagnose it faster.
- Your WordPress version and PHP version
- MalCare plugin version
- Any error messages shown in the dashboard
- Steps you already tried
- Whether other security or caching plugins are active
- Whether the issue began after a migration, update, or firewall change
Clear technical details make it easier to identify whether the problem is a plugin issue, a server restriction, or a configuration conflict.