Malware scanning and remediation

Webcore includes site-level malware tooling for managed WordPress installations. Scans run on the hosting node while scan history, findings and remediation state are presented through the Panel.

Run a scan

Start a malware scan from the site's Malware page. Large sites can take substantially longer than small installations, so scanning is handled as background work rather than requiring the browser request to remain open until the filesystem has been inspected.

The scanner evaluates the managed site using Webcore's malware rule packs and records findings for review.

Review findings

Treat a malware finding as evidence that requires review, not as permission to delete arbitrary site data. Legitimate plugins, themes or custom application code can sometimes contain patterns that resemble malicious techniques.

Use the finding details, affected path or database location and the site's expected application behaviour before taking remediation action.

File quarantine

Suspicious files can be moved into Webcore's quarantine rather than immediately destroyed. Quarantined files are stored outside the site's public document root and can be restored when appropriate.

Quarantine is preferable to manual deletion when you need a reversible first response. After quarantine, validate both the public site and WordPress administration because a compromised file may also have been a required application file.

Database findings

Malware can also persist in WordPress database content. Where the Panel exposes a supported database remediation action, review the affected WordPress object or option carefully before applying it.

Database remediation should be treated as a data change. Keep a usable backup or restore point before destructive remediation when the affected content is not trivially reproducible.

Scan history and remediation history

Webcore records malware scans and remediation actions so operators can distinguish the latest state from earlier findings and review what action was taken.

After remediation, run another scan rather than assuming that removing one finding has removed the entire compromise.

Recommended incident workflow

1. Run a current scan and review all findings.
2. Preserve a backup or restore point when appropriate for investigation and recovery.
3. Quarantine clearly suspicious files instead of deleting them manually.
4. Review supported database findings before applying destructive actions.
5. Check WordPress users, plugins, themes and configuration for unexpected changes.
6. Update or replace the vulnerable component that allowed the compromise.
7. Rotate affected credentials when compromise may have exposed them.
8. Run another malware scan and validate the site after remediation.

Malware cleanup is only one part of incident recovery. If the original entry point remains vulnerable, malicious content can return after a clean scan.