Find suspicious files, understand what BitFire discovered, and take the safest action, without needing to read PHP code.
Repairs and deletions change files on your live website. Make a complete backup of the website files and database, confirm that you can restore it, and keep a copy outside the hosting account when possible.
Start the scan from WordPress, then continue with other work or return after it finishes.
Sign in to WordPress, open the BitFire menu, and select Malware Scan.
Select the blue Scan File Now button in the upper-left corner.
The scan normally takes one to two minutes. You can leave the page; BitFire continues scanning in the background.
Run a manual malware scan no less than once each month.
Automated scans can check the website up to two times each day.
BitFire uses a sensitive scanner to find hidden malware while avoiding automatic deletion of legitimate files.
BitFire looks for code that can run commands, upload files, read data, or hide its purpose.
Known files are compared with clean versions from the WordPress.org repository.
Files without an official comparison are reported for administrator or AI review.
Many legitimate WordPress files perform powerful actions. Paid plugins, custom themes, agency code, encryption libraries, and third-party integrations may be flagged because no official repository copy is available.
A clear review order helps you address likely malware before spending time on paid or custom software.
These files will almost always be malware. Repair them first when a verified replacement is available.
Upload folders normally hold media, so an unknown PHP program needs immediate attention.
These files do not have an obvious legitimate source.
Attackers often create unfamiliar names or change files during an infection.
Open the file to see why BitFire flagged it.
Find the highlighted line marked with the red MAL label.
Check the file name, location, highlighted code, and available analysis.
BitFire sends the suspicious parts of a file for a second opinion and returns an explanation of the likely purpose and risk.
Choose the files that concern you most.
Select Analyze with AI and read the assessment.
If the answer is inconclusive, select Re-Analyze for additional context.
Only suspicious sections of the file are sent to a top-tier AI model. BitFire does not send the domain or other site-identifying information with those sections.
| Capability | FREE | PRO |
|---|---|---|
| Malware scanner | Same scanner | Same scanner |
| AI scan credits | 12 for the life of the domain | 1,000 credits |
| Scan schedule | Manual | Automated, up to twice daily |
Allow only known-safe files, repair from a verified source when possible, and delete only confirmed malware.
Use for a paid, custom, or third-party file you trust. BitFire approves only the current version and scans it again if its contents change.
Replace a modified file with the verified version from WordPress.org. Scan again and test the related feature afterward.
Delete confirmed malware when no clean replacement is available. Never delete an uncertain file or folder without a backup.
If an infection installed a complete malicious plugin, remove its folder with your hosting provider's file manager or file-transfer service. Avoid using Delete on the WordPress Plugins screen because that may run the plugin's uninstall code first.
If an attacker is still changing files, normal cleanup alone may not be enough to regain control.
Email support@bitfire.co. Our team can help lock down the WordPress installation and provide an offline recovery script.
Email emergency supportThe offline recovery script can restrict the entire server while recovery is in progress.
Once the attacker can no longer keep changing files, you can scan, repair, and remove malware.
Removing infected files is only part of recovery. Also address outdated software, stolen passwords, unexpected accounts, and active login sessions.
Security salts protect WordPress login cookies. Replacing them logs out every existing WordPress session, including a session stolen by an attacker. It does not change user passwords.
Make a copy of wp-config.php, then open it with the host's file manager or SFTP.
They begin with AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and the four matching _SALT names.
Open the official WordPress.org secret-key generator and replace the existing eight lines with the new ones.
Do not change any other part of the file. Save it, then sign in to WordPress again.
Advanced malware may leave processes, tasks, users, database entries, or server access behind after infected files are removed.
Unexpected processes may continue running outside a normal page request.
Malicious cron jobs can recreate deleted files later.
Redirects, spam, and startup code can hide in WordPress data.
Unexpected administrator accounts can let an attacker return.
Altered startup files can reload malware when WordPress runs.
Compromised hosting or file-transfer credentials can restore the infection.
Experienced administrators can download a suspicious file and open it in a plain-text editor. Heavily obscured code, extremely long lines, encoded text, random names, or code that hides its purpose may be warning signs, but none proves malware by itself.
These are the terms you are most likely to see while reviewing and cleaning a website.
wp-config.php that protect login cookies. Changing them logs out existing sessions.Quick answers to the questions WordPress administrators ask most often.
No. A flagged file needs review, but it may belong to a legitimate paid plugin, custom theme, or third-party integration that BitFire cannot compare with WordPress.org.
Repair modified WordPress core files first. Next review unknown PHP files in upload folders, suspicious files outside recognized plugins and themes, and files with random names or recent modification dates.
Yes. The scan continues in the background and normally finishes within one to two minutes. You can return to the Malware Scan page later.
No. FREE and PRO use the same malware scanner. PRO adds automated scheduling, Threat Hunter features, and 1,000 AI credits. FREE includes 12 AI credits for the lifetime of the domain.
No. BitFire sends only suspicious sections of the file. No site-identifying information is sent with those sections.
No scanner can guarantee every part of a server is clean. A confirmed infection may also involve scheduled tasks, database content, users, sessions, or compromised server credentials.
Email support@bitfire.co. For a failed scan, include the domain and browser console log. For a failed file action, include the domain, file path, and error message.
Send the website domain, full file path, scan result, and any symptoms you noticed. BitFire Support can help you choose the safest action.