WordPress security check
Know whether your site is clean, with a written verdict.
Request a check
A hacked site rarely looks hacked.
A compromised WordPress site usually keeps working. The signs are a redirect only some visitors see, an administrator nobody remembers creating, or a warning from a search engine.
This service is for organisations that depend on a WordPress site and need to know, with evidence, whether it is clean.
What we check
File integrity
WordPress core and plugin files compared against the official checksums.
Malware, twice
Two independent scanning engines. A file flagged by both is escalated.
The database
Users, settings, scheduled tasks and injected content.
Configuration and persistence
The places an intruder uses to stay: configuration files, access rules and must-use plugins.
Known vulnerabilities
Installed versions checked against known flaws and against current releases.
Honest gaps
A check that could not run is reported as not run, never as clean.
From the first scan to a clean verdict.
The order is fixed: nothing is removed before it is recorded, and nothing is called clean before it is checked again. The times are from our most recent engagement.
Day 1
A copy, then a first scan
We take a full backup and work on the copy, so your live site and the evidence stay untouched. The first scan took 38 minutes.
Backup and scan log
Day 4
First written report
Every finding is recorded with its evidence and a severity. A finding flagged by both scanning engines is marked as confirmed.
Summary for management, technical assessment
Clean-up day
Every way back in is closed
Malicious files and unknown administrator accounts are removed, all sessions ended, every key, salt and password replaced, scheduled tasks and running processes reviewed.
Runbook with a sign-off for each step
The day after
The re-scan gate
A fresh backup goes through the same scan. Each earlier finding is marked cleared, still present or not checkable before the site gets a verdict.
Verdict: clean, residual risk or not cleared
Two weeks later
The check-up
We scan again and re-test every earlier finding. Last time this caught a fix that had quietly been undone; it was closed again within three days.
Verification report
Any hosting provider
The assessment runs on a backup of your site, against the official WordPress checksums and open rule sets, so it does not rely on your host's tools. A few checks, such as scheduled tasks, need shell or panel access.
Every hole on record
Each finding keeps its evidence, its fix and the result of its re-test. A finding we sign off as harmless still appears in the report, with the reason, the author and the date.
Nobody left inside
Evidence is preserved first. Then access is reset as a whole, not account by account, and the list of administrators goes to you to confirm.
What you get
- Assess: we work on a backup, away from your live site, and report what we find.
- Clean: a verified rebuild on a clean copy, which must pass a re-scan before it counts as clean.
- Verify: a repeat check with a verdict of clean, residual risk, or not cleared.
- A plain-language summary for management, a technical report, and a runbook for whoever operates the server.
How we work
The checks are scripted and repeatable, so a later check can be compared with the first. A person reviews every finding before it reaches you.
- Official WordPress checksums
- Wordfence CLI
- YARA