Scheduled
A cron action waits until cleanup is finished, then runs the reinfection code again.
BitFire PRO · Threat Hunter
Cleaning malware is not enough. Remove its way back in.
Threat Hunter investigates the persistence mechanisms a normal file scan cannot see—from scheduled tasks and database triggers to rogue administrators and long-running PHP processes.
- Find persistence beyond infected files
- Investigate from one WordPress dashboard
- Disable, close, or terminate discovered threats
6focused audit tabs
1connected investigation
PROadvanced protection feature
The problem after cleanup
The infected file may be only the symptom.
Attackers design malware to survive removal. A clean file scan can be followed by another compromise if hidden code is still scheduled, running in memory, stored in the database, or backed by a privileged account.
Start with the malware scannerStill running
A background PHP process watches repaired files and restores malicious changes.
Hidden in data
A database trigger, stored script, iframe, or rogue administrator opens a path back in.
Six connected investigation surfaces
Hunt every place malware can persist.
Each tab answers a different incident-response question, then gives the operator the evidence and controls needed to act.
01 / STARTUP CHAIN
Verify every file WordPress loads.
Report the malware scan status of every file in the WordPress initialization path and identify files that have been modified. The audit follows the startup path through server directives, WordPress core, must-use plugins, active plugins, and the current theme so suspicious code loaded on every request is easier to isolate.
02 / CRON AUDIT
Expose delayed reinfection.
Inspect actions scheduled through WordPress cron and the Linux system cron. Threat Hunter helps identify suspicious handlers, orphaned tasks, runtimes, and code that could wait until later to rebuild an infection.
03 / MU-PLUGINS
Review code that must run.
See the malware status of every must-use plugin loaded early by WordPress. Review unfamiliar entries and temporarily disable an MU-plugin from a simple control while you investigate.
04 / ADMIN USERS
Take back privileged access.
See every administrator, flag suspicious users, and temporarily disable an account without losing the evidence around it.
- Sessions and locationView active sessions, inspect their geographic location, and close any session.
- Application passwordsReview application passwords and the activity recorded for each administrator.
- Salt rotationRotate WordPress salts to invalidate every existing login cookie.
- SQL trigger discoverySearch for database triggers that could recreate a backdoor administrator while bypassing PHP file scanning.
05 / PROCESSES
Stop malware that is still running.
Find long-running PHP background processes that monitor infected files and immediately restore malicious code after a repair. When the host provides the required access, an administrator can terminate the persistence process from Threat Hunter.
06 / CONTENT
Find executable content in the database.
Scan WordPress data for inline scripts, external script sources, and iframes that can execute code from another server. Use AI-powered analysis to assess whether a discovered script appears legitimate, suspicious, or malware-related before taking action.
From evidence to containment
Investigate in the order malware executes.
Threat Hunter connects file findings with the systems around them, helping you move from “the scan is clean” to “the persistence path is closed.”
- 01Scan
Run a fresh malware scan so Threat Hunter starts with current file status.
- 02Verify startup
Confirm the code loaded on every WordPress request before repairing the rest of the site.
- 03Remove persistence
Audit jobs, accounts, triggers, content, and processes; contain only what the evidence supports.
- 04Scan again
Repeat the scan, test the website, and monitor for unexpected changes.
Available with BitFire PRO
Do not clean the same infection twice.
Add Threat Hunter, runtime protection, and expanded AI malware analysis to your WordPress security workflow.