WordPress websites are a common target for hackers, spammers, and other malicious parties because it’s most popular CMS software that used by people either for simple blogging or other purposes. There are too many methods to infect your website with malware but the most common way is tweak or add the malicious codes into the themes, plugins for their own gain. Some of the common reasons are to get a backlink from your blog, to add adverts, redirect your website to spam links or worst of all to create a backdoor access to your website.
In this article, we would like to show you services and plugin solutions that will help you detect malicious code on your WordPress website. There are both free and paid tools available to scan your WordPress site for potentially malicious or unwanted code
1. Security Ninja
- perform 35+ security tests including brute-force attacks
- check your site for security vulnerabilities and holes
- checks for Timthumb vulnerability
- take preventive measures against attacks
- don’t let script kiddies hack your site
- prevent 0-day exploit attacks
- checks for Shellshock server bug
- use included code snippets for quick fixes
- extensive help and descriptions of tests included
- test the plugin (+ details, help, FAQ)
Security Ninja cannot guarantee the safety of your site. It can make your site far more difficult to hack, but there is no such thing as an impregnable website.
Scanning your site with Security Ninja and actioning the recommended improvements will increase the security of your site by a huge margin.
2. Theme Authenticity Checker (TAC)
TAC searches the source files of every installed theme for signs of malicious code such as hidden footer links and Base64 codes. If such code is found, TAC displays the path to the theme file, the line number, and a small snippet of the suspect code.
It can find things such as footer links and Base64 code injections. Then what do you do? Just because the code is there doesn’t mean it’s not supposed to be or even qualifies as a threat, but most theme authors don’t include code outside of the WordPress scope and have no reason to obfuscate the code they make freely available to the web.
3. Smart Security Tools
Smart Security Tools is a powerful plugin for improving security of your WordPress powered website. Plugin contains collection of tweaks and tools for extra security protection along with Security Advisor that can help you determine what needs to be done.
Plugin includes integration of VirusTotal and Sucuri Free Security Scanners (shows malware on the website and blacklisting status on major security related websites). Plugin includes database based Security Log that can log different event types you can use to determine problems, potential attacks and exploits, IP’s used for access, referrers, user agents… You can ban IP’s from Security Log.
4. Exploit Scanner
Exploit Scanner is another free WordPress plugin that is much more robust than the Theme Authenticity Checker because it search all files and database of your WordPress install. It checks for signs that may indicate if your installation has fallen victim to malicious hackers.
This plugin searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames.
It does not remove anything. That is left to the user to do.
5. WP Security Audit Log
WP Security Audit Log keeps a log of everything happening on your WordPress blog or website and WordPress multisite network. By using WP Security Audit Log security plugin it is very easy to track suspicious user activity before it becomes a problem or a security issue. A security alert is generated by the plugin when:
- New user is created via registration or by another user
- User changes the role, password or other profile settings of another user
- User on a WordPress multisite network is added or removed from a site
- User uploads or deletes a file, changes a password or email address
- User installs, activates, deactivates, upgrades or uninstalls a plugin
- User creates a new post, page, category or a custom post type
- User modifies an existing post, page, category or a custom post type
- User creates, modifies or deletes a custom field from a post, page or custom post type
- User adds, moves, modifies or deletes a widget
- User installs or activates a new WordPress theme
- User changes WordPress settings such as permalinks or administrator notification email
- WordPress is updated / upgraded
- Failed login attempts
- and much more…
Conclusion
The real value of this plugin is that you can quickly determine where code cleanup is needed in order to safely enjoy your theme. Remember, the best way to protect yourself from these malicious codes is to buy a Premium theme, plugin from a trusted source.