We got hacked. Then we got angry. Then we built Malwipe.

In late 2024, my WordPress site — a portfolio I'd built and hosted myself, running standard-issue security plugins — got hacked. I cleaned it. A week later it happened again. I paid a "WordPress expert" ₹15,000 to clean it properly. Two weeks later, it happened a third time.

I was running Wordfence Premium. I was running fail2ban. I had two-factor auth. None of it mattered because the shell was in a mu-plugin nobody thought to check, and the reinfection path was a nulled Elementor add-on I'd inherited from a previous freelancer.

The problem wasn't a lack of security tools. It was that none of them explained anything. Wordfence would flag a file as "suspicious" and move on. Sucuri wanted $299/yr and DNS control. MalCare's dashboard hid every decision behind a black box.

I wanted a tool that would tell me: this file changed by one byte, here's the byte, here's what it does, here's who dropped it, here's your rollback. Nothing existed. So I built one.

Malwipe started as a weekend bash script that byte-compared WordPress core files against the signed manifest on WordPress.org. On the first run, it caught the shell in 4 seconds. The second version added an AI verdict on ambiguous files using Claude Haiku. The third added the upload firewall. Today it's a full WordPress plugin protecting 2,000+ sites, and it's bootstrapped, profitable from month three, and it has never taken a dollar of VC money.

I don't want Malwipe to be enterprise software. I want it to feel like the tool a friend built for you in a weekend — honest, direct, priced fairly, and with a founder who reads every WhatsApp message. That's what we optimize for.

— Machhindranath Kalan, Founder