If you run a WordPress site, knowing how to use Wordfence to scan malware is a practical way to spot infections, file changes, and vulnerable plugins early.
This guide shows how the scanner works, what the results mean, and what to do next if Wordfence finds a problem.
What Wordfence does during a malware scan
Wordfence is a security plugin for WordPress made by Defiant.
Its scanner checks core WordPress files, plugins, themes, and other locations for known malware signatures, suspicious code patterns, altered files, and security issues that could indicate compromise.
Unlike a simple antivirus tool, Wordfence is built for the WordPress ecosystem.
That means it compares files against the official WordPress repository, looks for changes in plugin and theme files, and flags code that resembles backdoors, web shells, injected spam, or malicious redirects.
- Scans WordPress core files for unauthorized changes
- Checks plugins and themes for malware signatures
- Identifies outdated software and known vulnerabilities
- Looks for suspicious file permissions, executable files, and hidden threats
- Alerts you to indicators of compromise that may need manual review
How to use Wordfence to scan malware step by step
Once Wordfence is installed and activated, the scan process is straightforward.
The key is to understand the scan settings so you know what the plugin is checking and why a result matters.
1. Install and activate Wordfence
Go to your WordPress dashboard, open the Plugins section, and install Wordfence Security from the official WordPress plugin repository.
After activation, Wordfence adds a security menu to your dashboard with options for Firewall, Scan, Tools, and Login Security.
2. Open the scan screen
In the WordPress admin area, navigate to Wordfence and select Scan.
You will see the current scan status, previous scan history, and a button to start a new scan.
If Wordfence recommends a configuration update, apply it before scanning so the checks run with current rules and definitions.
3. Start a new scan
Click Start New Scan to begin.
Wordfence will examine core files, installed plugins, active themes, posts, comments, and other areas depending on your scan configuration.
On larger sites, the scan can take several minutes or longer.
4. Watch the scan results as they appear
During the scan, Wordfence may flag items as informational, warning, or critical.
Not every alert means malware is present.
Some warnings indicate outdated software, weak settings, or files that differ from the expected version.
5. Review each alert carefully
After the scan completes, review every result instead of focusing only on the most severe items.
The value of Wordfence comes from combining file integrity checks, malware signatures, and vulnerability data into a single report.
A single suspicious file may be enough to justify deeper investigation.
Which Wordfence scan settings matter most?
If you want a more thorough malware check, review the scan options in Wordfence settings.
The default configuration works well for many sites, but some environments benefit from more aggressive checks.
- File scan sensitivity: Higher sensitivity can detect more suspicious patterns, but it may also produce more false positives.
- Scan images and archives: Useful when attackers hide malicious code inside compressed files or embedded content.
- Check for unauthorized file changes: Important for spotting modified core, plugin, and theme files.
- Compare against repository versions: Helps identify files that do not match trusted source copies.
- Check posts and comments for dangerous URLs: Helpful for detecting spam links and SEO spam injections.
For many administrators, the best approach is to keep the default protections enabled and increase sensitivity only when investigating an active incident.
How to interpret Wordfence malware scan results
Knowing how to use Wordfence to scan malware is only useful if you can interpret the findings correctly.
The plugin may report issues that are harmless, suspicious, or urgent, and the difference matters.
Common result types
- Modified files: Files changed from the official version can be legitimate, but they should be verified.
- Known malware signatures: These are the strongest indicators of infection and usually require immediate action.
- Outdated plugins or themes: Vulnerable software may not be malware itself, but it can be the entry point.
- Suspicious code: Obfuscated PHP, base64 encoding, eval functions, and long random strings deserve careful review.
- Broken links or SEO spam: May indicate spam injections or defacement attempts.
False positives and legitimate custom code
Some developers use custom functions, caching logic, or encoded libraries that trigger warnings.
Before deleting anything, confirm whether the file belongs to a custom theme, child theme, or plugin you recognize.
If needed, compare the flagged file to a known-good backup or version control copy.
What should you do if Wordfence finds malware?
If Wordfence flags a likely infection, respond methodically.
Fast action reduces the chance of reinfection, data loss, or account abuse.
- Back up the site first: Save the database and files before making changes, even if the backup may contain malware.
- Isolate the affected file: Note the path, file name, and reason for the alert.
- Restore clean copies: Replace altered WordPress core, plugin, or theme files from trusted sources.
- Remove malicious code: Delete infected snippets only if you are confident the rest of the file is clean.
- Reset passwords: Change WordPress admin, hosting, FTP, SSH, and database credentials if compromise is suspected.
- Review user accounts: Remove unknown administrators and check for unauthorized role changes.
- Rescan after cleanup: Run Wordfence again to confirm the issue is resolved.
If the infection is severe or recurring, a professional WordPress malware removal service may be necessary, especially if attackers have created backdoors or modified server-level files.
How often should you run Wordfence scans?
Scan frequency depends on site size, traffic, and risk exposure.
For small business sites, weekly scans are common.
High-traffic stores, membership sites, and sites with frequent plugin changes may need daily scans or scheduled checks after major updates.
It is also smart to scan after any of these events:
- Installing a new plugin or theme
- Updating WordPress core, plugins, or themes
- Seeing suspicious redirects, pop-ups, or spam content
- Noticing a drop in search rankings or indexing issues
- Receiving hosting or browser warnings about malware
Best practices to improve Wordfence scan accuracy
Wordfence works best when the rest of your security posture supports it.
A good scan is easier to trust when the site is organized and kept current.
- Keep WordPress, plugins, and themes updated
- Delete unused plugins and themes instead of leaving them inactive
- Use reputable plugin sources from the WordPress.org repository or trusted vendors
- Maintain clean backups so you can compare suspicious files quickly
- Enable Wordfence firewall protection to block common attacks before they land
- Use strong passwords and two-factor authentication for administrative accounts
Keeping the site lean reduces the number of files Wordfence must evaluate and makes suspicious changes easier to spot.
Can Wordfence remove malware automatically?
Wordfence can repair some changed WordPress core, plugin, and theme files by restoring official versions, and it can help you identify malicious code for manual cleanup.
However, automated repair is not always enough when attackers have added hidden backdoors, modified database content, or compromised server credentials.
For that reason, treat Wordfence as both a scanner and an investigation tool.
The scan tells you where to look; your response determines whether the site is truly clean.
When a Wordfence scan is not enough
Sometimes malware hides outside the normal WordPress file structure.
Attackers may place code in uploads folders, must-use plugins, cron jobs, .htaccess rules, or hosting accounts.
In those cases, a Wordfence scan is still valuable, but it should be paired with server log review, hosting-level malware checks, and a full credential reset.
If the site keeps getting reinfected after cleanup, the likely causes are a backdoor, weak credentials, an outdated plugin, or a compromised hosting account.
That pattern usually means the original entry point has not been removed.