Title: Moatline Malware Scanner Author: Next Nova Technologies Published: Octubre 11, 2026 Last modified: Octubre 15, 2026 --- Search plugins ![](https://ps.w.org/moatline-malware-scanner/assets/banner-772x250.png?rev=3739992) ![](https://ps.w.org/moatline-malware-scanner/assets/icon.svg?rev=3739992) # Moatline Malware Scanner By [Next Nova Technologies](https://profiles.wordpress.org/nextnova/) [Download](https://downloads.wordpress.org/plugin/moatline-malware-scanner.1.0.5.zip) * [Details](https://bal.wordpress.org/plugins/moatline-malware-scanner/#description) * [Reviews](https://bal.wordpress.org/plugins/moatline-malware-scanner/#reviews) * [Installation](https://bal.wordpress.org/plugins/moatline-malware-scanner/#installation) * [Development](https://bal.wordpress.org/plugins/moatline-malware-scanner/#developers) [Support](https://wordpress.org/support/plugin/moatline-malware-scanner/) ## Description Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake “verify you’re human” pop- ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database. #### Malware scanner * Scans plugins, mu-plugins, the active theme, drop-ins, wp-login.php and the uploads folder. * Signature detection for known WordPress malware families, plus heuristic checks for obfuscated code and webshells. * Finds PHP webshells in uploads, fake image files used to store stolen credentials, decoy plugins and payload files. * Checks the database for malicious options, cron hooks, rogue administrator accounts and scripts injected into posts and pages. * Results name the malware family that matched, so you know what you’re dealing with. #### Content scan Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead. * Checks posts, pages, revisions, page-builder data (such as Elementor) and widgets for injected scripts. * Detects DNS-based script loaders, blockchain-hosted loaders, heavily obfuscated JavaScript and known malware domains. * Ordinary scripts such as analytics or form embeds are not flagged. * Each finding links straight to the post or widget so you can remove the injected code. #### Integrity check against WordPress.org Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version. * Files identical to the official release are verified clean and skipped, which keeps false positives low. * Files that differ are flagged as modified. That is exactly where injected malware hides. #### Two-factor login * Works with any authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others. * Each user scans a QR code on their profile. The QR code is drawn on your site; the secret never leaves it. * 10 single-use backup codes, and administrators can reset two-factor login for a user who lost their phone. * Password logins over XML-RPC are refused for two-factor users, so the code screen can’t be bypassed. Apps use application passwords. #### XML-RPC protection * Three modes: allow, Jetpack-safe (only Jetpack’s signed requests are accepted) or block completely. * Refuse password logins over XML-RPC and disable `system.multicall`, which attackers use to try hundreds of passwords in one request. * Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you. * Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy. #### Login protection and access * Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist. * Hide usernames from the REST API and block `?author=` username scans. * See every active login session with IP address and browser, including sessions left by deleted users. * One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php. * Audit and revoke application passwords, or turn them off. Every option that blocks something is off until you turn it on, and each one explains what it might affect. #### Live monitoring * Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API). * Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs. #### Lockdown * One-click file modification lock (`DISALLOW_FILE_EDIT` / `DISALLOW_FILE_MODS`) so attackers can’t install or edit plugins and themes through the dashboard. * Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided). #### Login security * Move the login page to a custom URL and hide wp-login.php. * Send bots probing the default login page to a 404. #### Database cron cleaner * Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click “Clean database”, and backs up everything it removes so you can restore it. #### Activity log * Records security-relevant events such as suspicious cron registrations, with export to JSON. #### Security score * A dashboard score and checklist that shows what to fix next. #### Pro add-on The free plugin finds and reports threats. The [Pro add-on](https://moatline.io/pro) is a separate, optional plugin for people who want them fixed automatically: one- click malware removal, restoring modified plugin files from WordPress.org, AI verification of findings, blocking of malware call-home connections, and daily scheduled scans with email alerts. Pro is never required to use the features above. #### Links * [Website](https://moatline.io) * [Documentation](https://moatline.io/docs) * [Changelog](https://moatline.io/changelog) * [Report a security issue](https://moatline.io/security) * [Support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/) * Email: support@moatline.io ### External services This plugin connects to WordPress.org to verify plugin files. **WordPress.org plugin checksums** (`https://downloads.wordpress.org/plugin-checksums/`) * What it’s used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged. * What is sent: the slug and version number of each installed plugin (for example` contact-form-7` and `5.9`), when you run a scan. No personal data, site content or file contents are sent. * Provided by WordPress.org: [Terms of Service](https://wordpress.org/about/terms-of-service/) and [Privacy Policy](https://wordpress.org/about/privacy/). If your server cannot reach WordPress.org, the scan continues without the integrity check. ### Credits QR codes for two-factor login are drawn with [qrcode-generator](https://www.npmjs.com/package/qrcode-generator) by Kazuhiko Arase (MIT licence), bundled in `assets/js/vendor/qrcode.js`. ## Screenshots [⌊Dashboard: security score, what was found and what to fix next.⌉⌊Dashboard: security score, what was found and what to fix next.⌉[ Dashboard: security score, what was found and what to fix next. [⌊A scan in progress: 13 short steps covering files, the database and the live home page.⌉⌊A scan in progress: 13 short steps covering files, the database and the live home page.⌉[ A scan in progress: 13 short steps covering files, the database and the live home page. [⌊Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database.⌉⌊Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database.⌉[ Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database. [⌊The dashboard after cleanup: no threats and a strong security score.⌉⌊The dashboard after cleanup: no threats and a strong security score.⌉[ The dashboard after cleanup: no threats and a strong security score. [⌊Lockdown: stop plugin and theme changes and block PHP in the uploads folder.⌉⌊ Lockdown: stop plugin and theme changes and block PHP in the uploads folder.⌉[ Lockdown: stop plugin and theme changes and block PHP in the uploads folder. [⌊Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks.⌉⌊Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks.⌉[ Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks. [⌊Two-step login with any authenticator app, set up from your profile.⌉⌊Two-step login with any authenticator app, set up from your profile.⌉[ Two-step login with any authenticator app, set up from your profile. ## Installation 1. In your dashboard go to Plugins Add New and search for “Moatline Malware Scanner”, or upload the `moatline-malware-scanner` folder to `/wp-content/plugins/`. 2. Activate the plugin. 3. Open Malware Scanner Scanner and run your first scan. 4. Work through the checklist on the Malware Scanner Dashboard page (Lockdown, Login Security, Settings). ## FAQ ### Will the scanner delete anything automatically? No. The free plugin never deletes or changes files on its own. Scans only report findings. The database cleaner runs only when you click “Clean database”. ### What happens when a file is flagged? You can review it, dismiss it, or exclude the path in Settings. Files that belong to WordPress.org plugins can be fixed by reinstalling that plugin. The Pro add-on adds one-click removal and restore. ### I lost my phone and can’t log in. What do I do? Use one of your backup codes. If you don’t have them, another administrator can reset your two-factor login from your user profile. As a last resort, add `define(' NNMS_DISABLE_2FA', true );` to wp-config.php, log in, and remove the line again. ### Will blocking XML-RPC break Jetpack or the mobile app? All XML-RPC options are off by default. If you use Jetpack, choose Jetpack-safe mode: Jetpack keeps working while password logins and multicall stay blocked. The WordPress mobile app can sign in with an application password. ### Can I use it alongside another security plugin? Yes. Moatline Malware Scanner is a scanner and hardening tool, not a firewall, so it runs alongside Wordfence, Sucuri, Solid Security, All-In-One Security and Jetpack. Your firewall blocks attacks; Moatline finds what got through and how it keeps coming back. Run one malware scan at a time if your hosting has limited resources. ### I set a custom login URL and I’m locked out. What do I do? Rename the `wp-content/plugins/moatline-malware-scanner` folder over FTP or your host’s file manager. This disables the plugin and restores the normal login page. ### Does it work on Nginx? Yes. Everything works on Nginx. For blocking PHP in uploads, the plugin shows the Nginx rule to add to your server configuration, because Nginx doesn’t read .htaccess files. ### Does the plugin send any data off my site? Only to check plugin files against WordPress.org, as described under “External services” below. No personal data is sent and there is no tracking. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Moatline Malware Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ Next Nova Technologies ](https://profiles.wordpress.org/nextnova/) * [ ibrahimshah2144 ](https://profiles.wordpress.org/ibrahimshah2144/) [Translate “Moatline Malware Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/moatline-malware-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/moatline-malware-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/moatline-malware-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/moatline-malware-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/moatline-malware-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.5 * Fixed: on sites without a mu-plugins folder (most sites), the checks for fake plugins and hidden binary payload files were skipped. They now always run. * New: database entries used by the fake CAPTCHA (ClickFix) loader that reads its address from the Polygon blockchain are named as such in scan results. * Changed: cleaner admin screens: no emoji on buttons, a two-column scan progress list, and a red “Threats found” headline on the dashboard while threats remain. * Changed: each database entry is reported once, even when several checks match it. * Fixed: Lockdown now shows “Locked” when DISALLOW_FILE_MODS was added to wp-config. php by hand or by your host. * Fixed: when the plugin folder is a symlink, the scanner now checks every plugin and still skips its own files. * Fixed: finished scan steps no longer keep saying “Scanning…”. * Fixed: XML-RPC Jetpack-safe mode now also recognises WooPayments and the standalone Jetpack plugins, which use the same WordPress.com connection. #### 1.0.4 * Fixed: the Moatline logo in the admin header did not show on some installs. #### 1.0.3 * New: redesigned admin screens, with a header and tabs on every page and a new dashboard showing your security score, what to fix next, recent activity and the database cleaner. * New: checks your live home page the way visitors see it, to catch fake CAPTCHA( ClickFix) scripts injected at page load. * New: detects the “X Global Data Flow” / “Traffic Monitor” fake plugins and new White Label CMS loader variants, including malware that empties other security plugins’ files. * New: the database cleaner backs up everything it removes, and a “Restore last backup” button puts it back. * New: warns you if Moatline’s own files have been emptied by malware, instead of failing silently. * Changed: the Documentation and Support links were removed from the Plugins screen row (they are on the plugin’s own pages). #### 1.0.2 * New: detects the fake “WordPress Defender”, “WordPress Security” and “White Label” plugins found on hacked sites in 2026, plus plugins whose author is just “WordPress”. * New: flags empty plugin files left behind by host malware cleaners, which can crash a site. * New: detects malware plugins that hide themselves from the Plugins list. * New: signatures for the mlroweb, latoem and renotad script injections. * New: Settings, Docs and Support links on the Plugins screen. * Changed: links now point to the new home of the plugin, moatline.io. #### 1.0.1 * Fixed: “Clean DB Now” stayed on “Cleaning…” and never finished. * Fixed: signing in from a custom login URL sent you back to the login page. * Changed: with a custom login URL, logged-out visitors to /wp-login.php and /wp- admin now see “page not found” instead of being sent to the new address. * Fixed: unlocking Full Lockdown no longer turns the file editor back on if you had turned it off separately. * New: Pause, Resume and Stop buttons while a scan is running. A paused scan can be resumed within 24 hours. * Changed: deleting the plugin keeps settings and two-step login setups unless you choose “Delete all plugin data” in Settings. #### 1.0.0 * Initial release. ## Meta * Version **1.0.5** * Last updated **3 hores ago** * Active installations **10+** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/moatline-malware-scanner/) * Tags * [hardening](https://bal.wordpress.org/plugins/tags/hardening/)[login security](https://bal.wordpress.org/plugins/tags/login-security/) [malware scanner](https://bal.wordpress.org/plugins/tags/malware-scanner/)[security](https://bal.wordpress.org/plugins/tags/security/) [two factor](https://bal.wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://bal.wordpress.org/plugins/moatline-malware-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/moatline-malware-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/moatline-malware-scanner/reviews/) ## Contributors * [ Next Nova Technologies ](https://profiles.wordpress.org/nextnova/) * [ ibrahimshah2144 ](https://profiles.wordpress.org/ibrahimshah2144/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/moatline-malware-scanner/)