Once you’ve confirmed that something suspicious is happening on your site, the next step is figuring out
exactly what’s hiding under the hood. Scanning for malware isn’t just about finding the obvious infected
files — it’s about uncovering hidden scripts, injected code, and the backdoors attackers leave behind to sneak
back in later.
This stage gives you a clear picture of what you’re dealing with so you can clean your site safely and completely.
Where to Start
1. Use Your Hosting Provider’s Malware Scanner
Most reputable hosting companies include built‑in malware detection tools. They’re not perfect, but they’re a
solid first pass because they scan your server at the file level and often catch common infections quickly.
These tools can help you:
- Spot recently modified or suspicious files
- Identify known malware signatures
- Flag unusual server activity
If your host alerts you to infected files, take note — don’t delete anything yet.
2. Use Reputable Third‑Party Scanners
Not all scanners are created equal. Some “free malware scanners” are actually malware themselves, so stick to
trusted names with a long track record in security.
Reliable scanners can:
- Detect obfuscated or hidden code
- Identify malicious redirects
- Flag unauthorized changes to core files
- Scan your database for injected content
Using more than one scanner is normal. Each tool catches different things.
3. Look for Backdoors (This Part Is Critical)
Hackers rarely rely on a single infection. They almost always leave behind a backdoor — a hidden file or script
that lets them re‑enter your site even after you clean it.
Common backdoor locations include:
- Uploads folders
- Theme and plugin directories
- Temporary or cache folders
- Files with names that look almost legitimate (e.g.,
wp-login-old.php,config-backup.php)
If you skip this step, the attacker can return instantly.
What NOT to Do During Scanning
- Don’t delete random files. You might remove something important or break your site further.
- Don’t reinstall plugins without checking them first. Some hacks originate from compromised plugins or themes.
- Don’t assume one scan is enough. Malware often hides in layers. Multiple scans with different tools give you a more complete picture.
This phase is about gathering information, not rushing into cleanup.
What Comes Next
Once you’ve identified the infected files and potential backdoors, the fastest and safest recovery method is
restoring from a clean backup — if you have one. That’s the focus of the next post in the series.
Need a Professional Malware Cleanup?
Green Monkeys Studio offers safe, thorough malware removal and security hardening.