Site Sentinel: A Free WordPress Plugin for Malware Scanning and Site Security

Every WordPress site owner eventually asks the same question: "How do I know my site hasn't been hacked?" The honest answer used to be "install a heavyweight security suite or pay for a monitoring service." I wanted a better option for my own client sites, so I built one. Site Sentinel is a free WordPress plugin that scans your site for malware, backdoors, and malicious code — and tells you exactly what it found and how serious it is.

The philosophy: detect and report, never destroy

Site Sentinel is built on one firm rule: it never deletes or modifies your files automatically. Automated "one-click cleanup" sounds attractive until a tool misjudges a critical file and takes your site offline. Site Sentinel gives you a precise, severity-ranked report — the file, the finding, the reason it was flagged — and leaves every decision with you. Detection is automated; judgment stays human.

What it checks

Core integrity, verified against WordPress.org

The scanner compares every WordPress core file on your server against the official checksums published by WordPress.org for your exact version. A single modified line in a core file — the classic hiding place for injected malware — is flagged as a critical finding. Files that are byte-identical to the official release are trusted and skipped by the deeper scans, which is one of the main reasons Site Sentinel's reports stay refreshingly free of false alarms.

Backdoors, web shells, and injected code

Plugins, themes, and uploads are scanned with a signature database of known backdoor and web-shell patterns — the standalone PHP files with innocent names that keep an attacker's access alive long after you've changed every password.

Heuristics for the unknown

New malware won't match yesterday's signatures, so Site Sentinel also performs heuristic analysis: obfuscated payloads, encoded strings fed to eval() or assert(), and other constructs that legitimate code rarely needs. These surface as medium-severity leads for review rather than screaming red alerts — proportionate to their real-world hit rate.

Uploads and image tricks

The uploads directory gets special attention, including detection of PHP payloads embedded inside otherwise-valid image files — a technique that walks straight past scanners which only look at file extensions.

A dashboard you can actually read

Scan results feed a clean, navy-branded dashboard: a status hero with gauge tiles for protection, scan coverage, and monitoring, a severity breakdown from critical to low, and a scan report that shows each coverage stage — core integrity, malware signatures, backdoors, heuristics, public files — with a clear pass or attention mark. Scan history and an activity log let you see at a glance when the site was last verified clean, which is precisely the question a worried client asks.

Built to run on real hosting

• Works on shared hosting. Scans run in small slices that never hit PHP time limits, and can resume cleanly — no VPS or WP-CLI required.
• Scheduled monitoring. Enable the schedule once and Site Sentinel keeps re-scanning automatically, so detection isn't something you have to remember.
• Private by design. Everything runs on your own server. Your files are never uploaded to a third-party service, and the plugin loads no external scripts, fonts, or CDNs.
• Free. Not freemium-crippled: the scanner, the heuristics, the scheduling, and the full report are all included.

How a scan works, start to finish

Under the hood, a Site Sentinel scan is a pipeline of narrowing filters:

1. Fingerprint. The scanner identifies your exact WordPress version and fetches the matching official checksums from WordPress.org.
2. Core diff. Every core file is hashed and compared. Byte-identical files are marked trusted and excluded from the deeper (more expensive) analysis — this is what keeps both scan time and false positives down.
3. Inventory. Plugins, themes, uploads, and stray files in the web root are enumerated, with special attention to PHP files sitting where PHP files don't belong.
4. Signatures, then heuristics. Known backdoor and web-shell patterns are matched first; what survives is analyzed heuristically for obfuscation, encoded payloads, and execution constructs that legitimate code rarely needs.
5. Report. Findings land in the dashboard ranked by severity, each with the file path and the reason it was flagged.

On shared hosting the pipeline runs in small resumable slices, so a 60-second PHP limit never kills a half-finished scan — it just picks up where it left off.

Reading the report: what each severity asks of you

• Critical — a modified core file or a known web shell. Treat it as an active compromise: back up for evidence, then replace or remove immediately.
• High — strong indicators like executable code in uploads or a recognized injection pattern. Investigate the same day.
• Medium — heuristic flags: obfuscated or oddly constructed code that might be legitimate. Check whether the file belongs to a plugin you trust, and compare it against a fresh copy of that plugin.
• Low — informational findings and hardening opportunities. Fold them into your next maintenance window.

The ranking is deliberate triage: a report that screams about everything gets ignored by week two. Site Sentinel's job is to make the ten minutes you give it count.

Why detection matters even on a "small" site

Compromised sites rarely belong to big brands — they belong to normal businesses whose hacked pages quietly serve spam links, phishing kits, and SEO poison. The cost lands later: blacklisted domains, collapsed rankings, and a "deceptive site ahead" warning that scares customers away. Regular scanning is the difference between catching an infection in day one and discovering it months later via Google. If you want to understand the detection techniques in more depth, read my guide on detecting malware and malicious code on a WordPress site.

Get it, and get help if you need it

Site Sentinel is free to use on as many sites as you like. Install it, run your first scan, and you'll know within minutes where your site stands. And if a scan turns up something ugly — or you'd rather have a professional own the whole security and update routine — my WordPress maintenance and support service includes malware cleanup, hardening, and ongoing monitoring. Get in touch any time.