Everything you need to know about the Malware Suspect Checker
Overview
The Malware Suspect Checker walks you through the most reliable indicators that a WordPress site has been compromised: unknown admin users, unexpected files in /wp-content/uploads, suspicious cron jobs, Google Safe Browsing warnings, sudden spam content, or unauthorised redirects to third-party domains. It does not scan files. Instead, it teaches you exactly where to look and what is normal versus suspicious.
If multiple indicators match, the tool recommends a structured response: isolate, snapshot, scan with a reputable security plugin, and either clean manually or engage a professional incident-response service.
Why this matters for WordPress site owners
Compromised WordPress sites are routinely abused for SEO spam injection, phishing redirects, cryptominers, and pharma hacks. Search engines deindex infected pages within hours, and hosting providers often suspend the account. Catching the indicators early is the difference between a one-hour cleanup and a multi-week recovery.
How to use this tool, step by step
- 1Tick the symptoms you have observed: unknown users, strange files, redirects, blocklist warnings.
- 2Indicate whether you have a recent clean backup available.
- 3Follow the recommended response based on the severity of matched indicators.
Expertise and methodology
Indicators are drawn from incident response patterns documented by Wordfence, Sucuri, Patchstack, and WPScan. WPRescue does not claim to perform full malware removal automatically; this tool is intentionally conservative and recommends professional cleanup for confirmed compromises.
Common mistakes to avoid
- Restoring an old backup without first patching the original vulnerability.
- Deleting suspicious files without taking a forensic copy first.
- Changing only the WordPress admin password but ignoring database and FTP credentials.