WordPress Malware Scanner: Find Suspicious Behavior, Understand the Evidence, Control the Response
Aegisify Shield 7.4.5 uses context-aware, behavior-correlated malware analysis to identify suspicious execution patterns, disguised PHP, droppers, persistence behavior, and related indicators while giving administrators confidence, rule evidence, scan profiles, incremental checks, quarantine controls, and incident correlation.
From Suspicious File to Incident Context
The scanner is designed to preserve administrator judgment while making stronger malware signals easier to investigate.
Click a stage
01ScopeSelect scan targets
02AnalyzeCorrelate behavior
03ExplainRules + confidence
04RespondSafe, close, quarantine
05CorrelateAttack Story
7.4.5 Uses Context Instead of Noisy Raw-Keyword Matching
The current malware engine is materially different from the older public description.
Execution Chains, Droppers, and Web-Shell Signals
Aegisify correlates request-controlled input with execution behavior, dynamic callables, decoder-to-execution chains, payload writes, web-shell capability markers, and persistence patterns. This reduces the chance that a legitimate isolated function name is treated as malware without supporting context.
PHP Where PHP Should Not Be
The engine looks for PHP hidden inside uploads and non-PHP files, including image-backed payload patterns and suspicious executable content in locations that normally store media or generated assets.
Bounded Analysis Without Ignoring Appended Payloads
The scanner performs complete analysis through bounded file sizes and uses targeted PHP windows plus head-and-tail inspection for larger files. This allows it to look for malicious code appended near the end of a large file without loading unbounded content into memory.
Confidence, Rule IDs, and Scan Errors
Findings can carry confidence, matched rule identifiers, engine version, and plain-language reasons. Unreadable or unresolved files are accounted for instead of silently being treated as clean, which makes the scan result more honest and operationally useful.
Scan Deeper Without Making Every Response Automatic
Aegisify separates detection sensitivity from response handling so teams can tune coverage without giving up change control.
Conservative, Balanced, and Aggressive
Conservative lowers sensitivity when false-positive reduction is the priority. Balanced is the recommended default. Aggressive lowers the detection threshold for deeper scrutiny and may report more suspicious files that require human review.
Background Malware Scans
Scheduled Scans keep malware review operating even when administrators are not logged in. This reduces dependence on manual reminders and supports a recurring security cadence appropriate to the site’s change rate and business importance.
Focus on Files That Actually Changed
Incremental Quick Scan uses file-monitor candidates and hashes to examine changed files without repeatedly scanning the entire installation. Unreadable candidates can be retried with bounded backoff, and pending work remains visible as partial rather than being misrepresented as complete.
WordPress Core Checksum Review
Administrators can run a separate WordPress core integrity check using official checksum data for the installed package context. This complements heuristic malware analysis by answering a different question: whether core files match the expected WordPress distribution.
Decisions Stay Bound to the Evidence
A “safe” decision should not become permanent permission for a file path that changes later. In the current implementation, Mark Safe exemptions are tied to the file’s exact SHA-256. If the file changes, the hash no longer matches and the file becomes eligible for malware review again.
Quarantine is also deliberately controlled. When selected and permitted by the configured handling mode, Aegisify stores the quarantined payload using a non-executable name in a protected quarantine area, applies access-deny controls, and places a harmless placeholder at the original path. Quarantine can still affect site functionality, so it should be used with backups, recovery access, and validation.
See Coverage and Threat Signals Before Opening Individual Findings
Understand What Happened Around a Malware Finding
A file detection is only one point in time. Attack Story correlates recent malware incidents with surrounding Activity Log, File Monitor, and Login Guard events. That can expose whether a suspicious file appeared after an unusual login, whether other files changed in the same window, and whether the finding was followed by quarantine or another response action.
The incident timeline is designed to shorten the first stage of investigation: identify the suspicious file, review related events, determine what else changed, and preserve a report for remediation or post-incident review. Supported incident reports can be opened for HTML/PDF-oriented export workflows.
This is especially useful after an update, suspected credential compromise, or reinfection event because the administrator can compare detection timing with the surrounding operational changes instead of reviewing the malware result in isolation.
Start With a Baseline Scan, Then Keep Watching Change
Run a reviewed malware and core-checksum baseline, tune the scan profile, then use scheduled and incremental scanning to maintain visibility as WordPress changes.
Common Questions
Does a malware finding prove a file is malicious?
No. The scanner provides heuristic evidence, confidence, rules, and reasons to support human review. Findings should be validated before destructive action.
What happens when I mark a file safe?
The current implementation binds the safe decision to the file’s SHA-256. If the file changes later, the previous hash exemption no longer matches the modified file.
Does Aegisify replace hosting antivirus or a WAF?
No. Shield provides WordPress-side malware and incident context and is designed to complement secure hosting, a WAF where appropriate, backups, updates, least privilege, and incident response.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.