Scanning a WordPress site sounds like one task and it’s actually two different questions with two different toolsets. Malware and vulnerability scanning asks “is something already wrong, or exploitable, right now.” Performance scanning asks a completely different question about speed and Core Web Vitals. Picking a tool starts with knowing which question you’re actually asking, since a security scanner won’t tell you why a page loads slowly, and a performance tool won’t catch a backdoor hidden in an uploads folder.
What “Scanning” Actually Checks For
A security scan looks for a handful of distinct problem categories: known vulnerabilities in specific plugin or theme versions, cross-referenced against a vulnerability database; malware signatures matched against files that shouldn’t be on the server; weak or compromised login credentials; and file changes that suggest something’s been tampered with since the last known-clean state.
Not every tool covers all four equally well. Some lean heavily toward malware cleanup, others toward vulnerability database matching, and knowing which gap you’re actually trying to close narrows the choice considerably before comparing feature lists line by line.
Wordfence
Wordfence runs its malware scanner and firewall directly inside WordPress, checking core files, themes, and plugins against known malware signatures and comparing file hashes against the official WordPress.org repository to catch unauthorized changes. The firewall component blocks malicious requests before they reach the site at all, which is a meaningfully different layer of protection than scanning after the fact.
The free version covers real, useful ground: malware scanning and a basic firewall, plus login security including rate limiting on failed attempts. The premium tier adds real-time firewall rule updates (the free version’s rules lag by 30 days) and a faster-updating vulnerability database, which matters specifically in the window right after a new vulnerability gets disclosed publicly, before most sites have patched.
Worth knowing before installing: Wordfence’s live traffic monitoring and full scans can add noticeable load on shared hosting with limited resources, particularly during a full site scan. Scheduling scans for low-traffic hours rather than running them at peak time avoids this becoming its own performance problem.
Sucuri
Sucuri approaches this from the opposite direction, its core value is a cloud-based firewall and CDN that sits in front of the site entirely, filtering malicious traffic before it ever reaches the WordPress installation, rather than relying primarily on a plugin scanning files after the fact. The free plugin does offer file integrity monitoring and a malware scanner, but Sucuri’s stronger offering is the paid cloud firewall service.
This matters for anyone who’s already been compromised: Sucuri’s incident response team, included with paid plans, handles the actual cleanup process, which is a genuinely different service than a self-service scanner that just tells you something’s wrong and leaves the fixing to you. For a site owner without the technical confidence to interpret a scan report and manually remove malicious code, this hands-on cleanup service is often worth the cost on its own.
The free version alone is thinner than Wordfence’s free tier for active protection, since the meaningful firewall layer sits behind the paid plan rather than in the free plugin itself.
MalCare
MalCare’s specific pitch is speed and automation: its scanner runs on MalCare’s own servers rather than the site’s hosting resources, which avoids the performance hit a resource-intensive scan can cause on a shared hosting plan, and its one-click malware removal aims to fix common infections without requiring the site owner to manually identify and delete malicious files themselves.
This automation is genuinely useful for a non-technical site owner facing an active infection, but it’s worth understanding what “automatic removal” actually does before relying on it as a complete fix: automated cleanup handles known, signature-matched malware patterns well, but a sophisticated or novel compromise may need the entry point manually identified and closed separately, since removing the malicious file without patching how it got there invites reinfection.
MalCare’s free tier covers scanning; the meaningful cleanup and firewall features sit behind a paid plan, similar to Sucuri’s structure.
iThemes Security
iThemes Security (recently rebranded as SolidWP in some product listings, worth checking which name your host or plugin directory shows) takes a hardening-first approach: rather than leading with malware scanning, it focuses heavily on closing common attack vectors before they’re exploited, brute-force login protection, two-factor authentication, file change detection, and database backups bundled together.
The free version is genuinely capable for a site owner who wants strong preventive hardening more than reactive scanning. Disabling file editing through wp-admin and enforcing strong passwords are covered without a paid upgrade, along with limiting login attempts. It’s a reasonable pairing with a dedicated malware scanner like Wordfence rather than a full replacement for one, since hardening reduces risk but doesn’t actively hunt for an existing infection the way a signature-based scanner does.
WPScan
WPScan is a command-line vulnerability scanner, not a WordPress plugin, and it’s built for developers and security professionals comfortable working outside wp-admin entirely. It checks WordPress core and installed plugins against WPScan’s own vulnerability database, along with themes, and it can test for weak credentials through a controlled brute-force check.
This is the right tool for a developer auditing a client site before handoff, or someone maintaining several sites who wants a scriptable check that can run as part of a deployment pipeline rather than a point-and-click dashboard. It’s the wrong tool for a site owner without command-line familiarity, the output is a vulnerability report, not a one-click fix, and interpreting it correctly requires understanding what each flagged CVE actually means for your specific setup.
WPScan also exists as a hosted API that some other security plugins query behind the scenes for their own vulnerability database, worth knowing since you might already be benefiting from WPScan’s data without running the CLI tool directly.
Choosing Between Them Based on What You Actually Need
If the site is already showing signs of compromise (unexpected redirects, a Google Safe Browsing warning, unfamiliar admin users), prioritize a tool with real cleanup support behind it, Sucuri or MalCare’s paid tiers, rather than a free scanner that identifies the problem and leaves removal entirely up to you.
If the goal is ongoing prevention on a site that hasn’t been compromised, Wordfence’s free tier plus iThemes Security’s hardening features cover most of the practical ground without a subscription cost. This pairing handles both the reactive (malware scanning) and preventive (hardening, login protection) sides reasonably well for a typical small business site.
If you’re a developer managing multiple sites or doing a pre-launch security audit, WPScan’s CLI output integrates into a workflow the dashboard-based tools don’t, and it’s worth learning even if a GUI plugin also runs on the live site.
None of this needs to be a permanent, single choice either. Plenty of site owners start with a free scanner for baseline coverage, then add a paid firewall or cleanup service specifically after a first real incident makes the gap obvious. Starting free and upgrading reactively isn’t a mistake, it’s a reasonable way to match spending to actual demonstrated risk rather than guessing upfront.
What No Scanner Catches on Its Own
Every tool above scans the WordPress installation itself. None of them audit the server environment underneath it, an outdated PHP version, a misconfigured file permission set, an exposed database port. These require either a hosting-level security review or a separate server audit tool, and it’s a genuine gap worth knowing about rather than assuming a WordPress security plugin covers the full stack.
Weak human practices are the other blind spot no automated scanner fully closes: a shared admin password reused across multiple sites, an old contractor account that was never deactivated, a personal email account with weak security that controls the domain registrar. A scan report can flag technical vulnerabilities all day and still miss the compromised credential that actually gets used in a real attack.
Running a Scan Without Crashing a Small Hosting Plan
A full site scan, checking every file against a signature database, is genuinely resource-intensive, and running one during peak traffic hours on modest shared hosting can slow the site down or, in worse cases, trigger the host’s own resource limits and temporarily suspend the account.
Schedule full scans for low-traffic windows, most scanning plugins let you set a specific time rather than running immediately. If a host does flag resource usage during a scan, check whether the scanner offers a lighter, incremental mode that only checks files changed since the last scan rather than the entire installation every time, several of the tools above support this and it’s a meaningful difference on a resource-constrained plan.
Verifying a Scanner Is Actually Working, Not Just Green
A security dashboard showing a reassuring green checkmark can mean the site is genuinely clean, or it can mean the scan silently failed to complete, timed out on a resource-constrained host, or never actually ran on schedule at all. Trusting the dashboard color without occasionally verifying it’s backed by a real, completed scan is a quiet gap worth closing.
The EICAR test file is the standard way to confirm a malware scanner is genuinely detecting threats rather than just reporting a clean result by default. It’s a harmless text string that every legitimate antivirus and malware scanner is designed to flag as if it were real malware, specifically so administrators can verify detection is working without needing actual malicious code. Uploading an EICAR test file to the server (via FTP, outside of any WordPress upload restrictions) and confirming the scanner catches it on its next run is a five-minute check that turns “the dashboard looks fine” into “the dashboard is actually checking something.”
Check the scan history or log, most tools above keep one, for the actual last-run timestamp too. A scanner that hasn’t completed a full run in three weeks because of a silent timeout or a resource limit on the host isn’t protecting anything, regardless of what the summary screen shows.
False Positives Are a Real, Recurring Annoyance
Security scanners occasionally flag legitimate code as suspicious, particularly custom functionality that uses patterns also common in malware, base64-encoded strings, dynamically evaluated expressions, or dynamically generated file paths, all of which show up in plenty of legitimate plugins and custom code alongside actual malicious scripts.
Before assuming a flagged file is a genuine infection, check the file’s actual origin. A flagged file inside a known, actively maintained plugin’s own folder, matching that plugin’s official version on WordPress.org, is very likely a false positive rather than a real compromise, scanners sometimes flag legitimate obfuscated or minified code from a plugin’s own build process. A flagged file with a random-looking name sitting in wp-content/uploads, a folder that should only ever contain media files, not executable PHP, is a much stronger signal of an actual problem.
Most scanning tools offer a way to mark a specific file as a known false positive so it stops re-flagging on every subsequent scan, worth using once you’ve genuinely confirmed a flag isn’t a real threat, rather than learning to habitually dismiss alerts, which is how a real infection eventually gets ignored along with the noise.
A Real Troubleshooting Scenario: A Scan Reports a Vulnerability in a Plugin You Can’t Update
A scan flags a known vulnerability in a specific plugin version. The obvious fix, update the plugin, isn’t available because the site is running a heavily customized fork of that plugin, or the current version conflicts with something else on the site and updating breaks a different feature entirely.
The real options here, in order of preference: check whether the plugin developer released a targeted security patch separate from the full version update, some vendors do this specifically for cases like this. If not, check whether the vulnerable functionality can be disabled entirely without removing the plugin, some vulnerabilities live in a specific feature (a file upload form, an API endpoint) that isn’t needed on every site. As a last resort, a web application firewall (Wordfence’s or Sucuri’s) can often virtually patch a known vulnerability by blocking the specific request pattern that exploits it, buying time until a proper update path exists.
What doesn’t work: ignoring the flag and hoping. A known vulnerability sitting unpatched on a public site is actively being scanned for by automated bots looking for exactly that signature, not a theoretical risk sitting quietly in a report nobody reads again.
Common Mistakes Worth Naming Directly
Running only one type of scan and assuming full coverage, pairing a malware scanner with zero hardening leaves brute-force and credential attacks wide open even on a site with clean files.
Scheduling resource-heavy full scans during peak traffic and blaming the resulting slowdown on the hosting plan instead of the scan itself.
Treating a clean scan result as permanent rather than a snapshot, new vulnerabilities get disclosed constantly, and yesterday’s clean report says nothing about a plugin update pushed this morning.
Relying entirely on automated cleanup for a serious compromise without verifying the actual entry point got closed, which just resets the clock until reinfection.
FAQ
Can I run more than one security plugin at once?
Running two full security suites (two firewalls, two malware scanners) often causes conflicts and duplicated resource use. Pairing a scanner with a separate, narrower hardening tool is usually fine; running two competing all-in-one suites side by side generally isn’t.
How often should a WordPress site actually be scanned?
Most tools default to daily automated scans, which is a reasonable baseline for most sites. High-traffic or e-commerce sites, where an infection has bigger real consequences, benefit from more frequent scanning, several tools support hourly checks on paid tiers.
Is a free scanner good enough for a small business site?
Often yes for basic malware detection and hardening. The gap between free and paid usually shows up in response speed (how fast the vulnerability database updates) and in cleanup support if something does get through, both of which matter more as the cost of downtime for that specific site increases.
Does a clean scan mean the site is definitely safe?
No, it means nothing matched the scanner’s current signature database at the moment of the scan. A zero-day vulnerability with no signature yet, or a targeted manual attack rather than an automated scan-and-exploit pattern, can bypass signature-based detection entirely.
Can I test whether my scanner actually catches something without a real infection?
Yes, the EICAR test file exists exactly for this. Upload it via FTP outside WordPress’s own upload restrictions and confirm the scanner flags it on the next run. A scanner that misses a known EICAR test file is worth investigating before trusting it with anything real.
What should I do immediately if a scan confirms an active infection?
Take the site into maintenance mode or fully offline first, change every credential connected to it, then work through cleanup with either the automated tool’s removal feature or a paid incident response service before bringing the site back live. Restoring from a backup taken before the compromise, once the entry point is identified and closed, is usually faster and more reliable than manually hunting through infected files line by line.
Where This Leaves You
Match the tool to the actual question. Wordfence and iThemes Security for ongoing prevention on a healthy site, Sucuri or MalCare when active cleanup support matters more than DIY scanning, WPScan for a developer’s audit workflow.
Schedule scans for low-traffic windows and pair a scanner with real hardening rather than expecting one tool to cover both sides. A clean scan result is a snapshot, not a guarantee, and the vulnerabilities that matter most are the ones disclosed after your last scan ran.
