Look beyond the homepage
Review infection signals from the connected website as well as what selected external checks can observe.
WordPress security with Sentinel
Find WordPress malware and know what needs your attention
A website can load normally while something harmful runs behind it. Sentinel brings malware findings, file changes, account warnings and outside checks into one view, so you can investigate the right website and the right problem.
For connected WordPress websites. Review current availability on plans and features.
Updated
The quick answer
How can I scan my WordPress site for malware?
Connect your website to WPCentrify and review Sentinel security findings. Sentinel checks for known malware and suspicious website changes and account activity, including supported database-related threats, alongside selected outside checks. It separates confirmed problems from findings that need review and shows recovery steps when there is evidence of a hack.
What you get
Malware scanning in WPCentrify
Separate suspicion from proof
A modified file can have a legitimate cause. Sentinel presents findings with context instead of treating every difference as confirmed malware.
Move from finding to response
Use the affected site security view to investigate, review related evidence and follow recovery steps when a compromise is established.
Malware scanning is different from vulnerability scanning
A vulnerable plugin has a known security weakness. It may still be uninfected. Malware means harmful code or behavior is present. A site can also be compromised without a matching published vulnerability, for example after an attacker obtains valid credentials.
Use WordPress vulnerability scanning to find known holes and Sentinel malware findings to investigate an existing infection. Our guide to scanning WordPress for malware explains the wider checks to make when you suspect a hack.
Check files, accounts and signs of persistent infection
Sentinel brings together known malware matches, suspicious executable files, modified components and account-related warnings. It can also flag supported database-related threats and signs of malware returning after cleanup. The available checks depend on the connected plugin and enabled monitoring controls.
A single warning may need a human answer. Review file integrity findings against legitimate updates, and confirm whether unfamiliar administrators belong to your team or host. Do not delete a production file solely because it was flagged as different.
Understand what a clean scan can and cannot tell you
No scanner proves that every part of a hosting account is safe. A failed, unavailable or incomplete check is different from a completed check with no finding. Review scan status and investigate missing visibility before treating a result as reassurance.
Sentinel does not promise automatic removal of every infection. When a website is compromised, preserve evidence, clean it carefully or assess an appropriate backup, rotate credentials and close the entry point. Reinfection monitoring helps investigate a problem that returns after that work.
Your next steps
How to use malware scanning
Connect and review the site
Install the current WPCentrify plugin and open the website security view in Sentinel.
Read findings in context
Review the affected files, accounts and related warnings. Separate known malware from changes that need confirmation.
Resolve and check again
Follow the appropriate cleanup or recovery path, fix the entry point and review subsequent security findings.
Common questions
Malware scanning questions answered
Can a WordPress site have malware and still look normal?
Yes. Harmful code may run in the background or affect only selected visitors. A normal-looking homepage does not replace checks of files, accounts and other infection signals.
Does Sentinel scan the WordPress database for malware?
Sentinel includes supported checks for database-related threats when available and enabled. It does not promise complete database coverage or detection of every injection.
Is a modified WordPress file always malware?
No. Updates, customizations and security tools can legitimately change files. Review the finding and the expected change before treating a file difference as malicious.
Can I scan multiple WordPress sites from one place?
Yes. Sentinel brings security verdicts and findings for connected websites into WPCentrify, with a site-level view for investigation.
Does Sentinel automatically clean every infected file?
No. Sentinel detects and explains findings and provides a recovery path. Cleanup or restoring a backup needs careful review and does not remove the need to fix the original weakness.
Do I need a malware scanner if my site has a firewall?
Yes, they cover different needs. A firewall helps stop covered incoming attacks. Malware checks help investigate harmful code or signs of compromise already on the site.
Related WordPress security features
File integrity monitoring
Review unexpected file changes
Explore this featureHidden admin detection
Investigate unexpected accounts
Explore this featureMalware reinfection
Investigate malware that returns
Explore this featureSee all Sentinel security features or follow the WordPress portfolio security guide.
WPCentrify Sentinel
Give every website a security review you can act on
Bring security findings, protection status and website maintenance into the same dashboard.