Every feature you need to keep WordPress clean

Every scan pulls the signed manifest from WordPress.org and byte-compares your installed core, plugin, and theme files against it. A single injected byte in wp-includes/pomo/mo.php is enough to trip a critical alert. Custom plugins with no manifest fall back to your own hash baseline set on install.

Signature-based scanners miss obfuscated payloads. We ship suspicious snippets (never full files) to Claude Haiku with a security-tuned prompt. It returns a plain-English verdict: what the code is trying to do, why it's suspicious, and how confident it is.

Every quarantined file is correlated with your web-server access log to identify the exact request that placed it. You see: IP, ASN, country, prior known incidents against other Malwipe sites, and a one-click block that ranges the /24.

A tiny drop-in .htaccess (Apache/LiteSpeed) or nginx snippet blocks PHP execution inside your uploads directory. Malwipe writes and verifies it on activation, monitors for tampering, and re-writes it if an attacker deletes it.

We maintain a fingerprint database of every leaked CodeCanyon-nulled plugin and theme with known backdoors. If your site is running one, we flag it, name the payload, and offer a one-click removal.

Detected threats are quarantined to a hardened location outside the webroot, not deleted. You get a 30-day undo. Core files are restored from WordPress.org signed archives, not from your backups.

Every finding gets a severity score (0-100) and a confidence rating (Low/Med/High/AI-Verified). Filter by 'High confidence + Critical severity' and clean 30 findings in 10 seconds. No more digging through 400 false positives.

Every Pro+ site is issued a signed magic URL on install. Even when wp-admin is white-screened, defaced, or hijacked, you can hit that URL and revert to the last clean state — no FTP, no host support ticket.