Warns about plugins under active attack, adds weekly automatic scans, file change monitoring and WP-CLI, and detects 2026's self-healing malware (core, wp-config.php and prepend-file changes, hidden admins, database triggers).<\/p>","1.0.6":"
Finds and blocks PHP webshells disguised as .phtml, .php5, .php8 and similar in uploads, as used in the Bricksforge attacks.<\/p>","1.0.5":"
Names fake CAPTCHA loaders hidden in the database, cleaner admin screens and several fixes.<\/p>","1.0.4":"
Fixes the logo not showing in the admin header.<\/p>","1.0.3":"
New dashboard, a live home-page check for fake CAPTCHA malware, new fake-plugin detections and a database cleaner backup.<\/p>","1.0.2":"
Detects new fake security plugins and malware injections seen on hacked sites this month.<\/p>","1.0.1":"
Fixes the database cleaner and custom login URL, and adds Pause, Resume and Stop for scans.<\/p>","1.0.0":"
Initial release.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3739992,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3739992,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3739992,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3739992,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3739992,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.2","1.0.3","1.0.5","1.0.6","1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3747375,"resolution":"1","location":"assets","locale":"","width":1280,"height":860},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3747375,"resolution":"2","location":"assets","locale":"","width":1280,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3747375,"resolution":"3","location":"assets","locale":"","width":1280,"height":791},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3747375,"resolution":"4","location":"assets","locale":"","width":1280,"height":860},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3747375,"resolution":"5","location":"assets","locale":"","width":1280,"height":900},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3747375,"resolution":"6","location":"assets","locale":"","width":1280,"height":900},"screenshot-7.png":{"filename":"screenshot-7.png","revision":3747375,"resolution":"7","location":"assets","locale":"","width":1280,"height":589}},"screenshots":{"1":"Dashboard: security score, what was found and what to fix next.","2":"A scan in progress: 13 short steps covering files, the database and the live home page.","3":"Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database.","4":"The dashboard after cleanup: no threats and a strong security score.","5":"Lockdown: stop plugin and theme changes and block PHP in the uploads folder.","6":"Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks.","7":"Two-step login with any authenticator app, set up from your profile."}},"plugin_section":[],"plugin_tags":[31093,1229,55021,600,9217],"plugin_category":[54],"plugin_contributors":[285890,285889],"plugin_business_model":[],"class_list":["post-380697","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-login-security","plugin_tags-malware-scanner","plugin_tags-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-ibrahimshah2144","plugin_contributors-nextnova","plugin_committers-n2securityio","plugin_committers-nextnova"],"banners":{"banner":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/banner-772x250.png?rev=3739992","banner_2x":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/banner-1544x500.png?rev=3739992","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/icon.svg?rev=3739992","icon":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/icon.svg?rev=3739992","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-1.png?rev=3747375","caption":"Dashboard: security score, what was found and what to fix next."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-2.png?rev=3747375","caption":"A scan in progress: 13 short steps covering files, the database and the live home page."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-3.png?rev=3747375","caption":"Scan results name each threat: a fake plugin, a webshell in uploads and fake CAPTCHA loaders hidden in the database."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-4.png?rev=3747375","caption":"The dashboard after cleanup: no threats and a strong security score."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-5.png?rev=3747375","caption":"Lockdown: stop plugin and theme changes and block PHP in the uploads folder."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-6.png?rev=3747375","caption":"Hardening: XML-RPC protection, login limits, hidden usernames and a 7-day summary of blocked attacks."},{"src":"https:\/\/ps.w.org\/moatline-malware-scanner\/assets\/screenshot-7.png?rev=3747375","caption":"Two-step login with any authenticator app, set up from your profile."}],"raw_content":"\n
Moatline Malware Scanner is built by a team that cleans up hacked WordPress sites for a living. It looks for the techniques modern infections use to hide and come back: code injected into legitimate plugin files, fake \"verify you're human\" pop-ups (ClickFix), blockchain-hosted loaders (EtherHiding), webshells in the uploads folder and hidden reinfection tasks in the database.<\/p>\n\n
Some infections never touch a file. Attackers who get into an account, or abuse a vulnerable plugin, hide their script inside the database instead.<\/p>\n\n
Every file in a plugin from the WordPress.org directory is compared with the official release of that exact version.<\/p>\n\n
system.multicall<\/code>, which attackers use to try hundreds of passwords in one request.<\/li>\n- Jetpack is detected automatically. If it is activated while XML-RPC is blocked, the plugin switches to Jetpack-safe mode and tells you.<\/li>\n
- Optional server rule for Apache and LiteSpeed (added to .htaccess only when you click the button, removed on deactivation). Nginx users get the rule to copy.<\/li>\n<\/ul>\n\n
Login protection and access<\/h4>\n\n\n- Limit login attempts on the login page, XML-RPC and the REST API, with an IP allowlist.<\/li>\n
- Hide usernames from the REST API and block
?author=<\/code> username scans.<\/li>\n- See every active login session with IP address and browser, including sessions left by deleted users.<\/li>\n
- One-click buttons: log everyone out, force a password reset for other administrators, regenerate the security keys and salts in wp-config.php.<\/li>\n
- Audit and revoke application passwords, or turn them off.<\/li>\n<\/ul>\n\n
Every option that blocks something is off until you turn it on, and each one explains what it might affect.<\/p>\n\n
Live monitoring<\/h4>\n\n\n- Records who saves a malicious script into a post, page or Elementor data, with the user, IP address and method (dashboard, XML-RPC or REST API).<\/li>\n
- Records logins and XML-RPC write calls such as wp.editPost, so an incident can be traced without server logs.<\/li>\n<\/ul>\n\n
Lockdown<\/h4>\n\n\n- One-click file modification lock (
DISALLOW_FILE_EDIT<\/code> \/ DISALLOW_FILE_MODS<\/code>) so attackers can't install or edit plugins and themes through the dashboard.<\/li>\n- Block PHP execution in the uploads folder (Apache rule written for you; Nginx rule provided).<\/li>\n<\/ul>\n\n
Login security<\/h4>\n\n\n- Move the login page to a custom URL and hide wp-login.php.<\/li>\n
- Send bots probing the default login page to a 404.<\/li>\n<\/ul>\n\n
Database cron cleaner<\/h4>\n\n\n- Removes known malicious cron hooks and option keys that reinstall malware after a cleanup. Runs only when you click \"Clean database\", and backs up everything it removes so you can restore it.<\/li>\n<\/ul>\n\n
Activity log<\/h4>\n\n\n- Records security-relevant events such as suspicious cron registrations, with export to JSON.<\/li>\n<\/ul>\n\n
Security score<\/h4>\n\n\n- A dashboard score and checklist that shows what to fix next.<\/li>\n<\/ul>\n\n
Pro add-on<\/h4>\n\n
The free plugin finds and reports threats. The Pro add-on<\/a> is a separate, optional plugin for people who want them fixed automatically: one-click malware removal, restoring modified plugin files from WordPress.org, one-click fixes for core files, server settings and database triggers, AI verification of findings, blocking of malware call-home connections (including blockchain gateways), daily scans, the full vulnerability database from Wordfence Intelligence, and a white-label security report for clients. Pro is never required to use the features above.<\/p>\n\nLinks<\/h4>\n\n\n- Website<\/a><\/li>\n
- Documentation<\/a><\/li>\n
- Changelog<\/a><\/li>\n
- Report a security issue<\/a><\/li>\n
- Support forum<\/a><\/li>\n
- Email: support@moatline.io<\/li>\n<\/ul>\n\n
External services<\/h3>\n\n
This plugin connects to WordPress.org to verify plugin and core files, and to moatline.io for a list of plugins under attack.<\/p>\n\n
WordPress.org plugin checksums<\/strong> (https:\/\/downloads.wordpress.org\/plugin-checksums\/<\/code>)<\/p>\n\n\n- What it's used for: comparing the files of your installed WordPress.org plugins with the official release, so unmodified files can be marked clean and modified files can be flagged.<\/li>\n
- What is sent: the slug and version number of each installed plugin (for example
contact-form-7<\/code> and 5.9<\/code>), when you run a scan. No personal data, site content or file contents are sent.<\/li>\n- Provided by WordPress.org: Terms of Service<\/a> and Privacy Policy<\/a>.<\/li>\n<\/ul>\n\n
WordPress.org core checksums<\/strong> (https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>)<\/p>\n\n\n- What it's used for: comparing your WordPress core files with the official release, so files changed by malware are found.<\/li>\n
- What is sent: your WordPress version number and language (for example
6.8.3<\/code> and en_US<\/code>), when you run a scan.<\/li>\n- Provided by WordPress.org: Terms of Service<\/a> and Privacy Policy<\/a>.<\/li>\n<\/ul>\n\n
If your server cannot reach WordPress.org, the scan continues without the integrity check.<\/p>\n\n
Moatline list of plugins under attack<\/strong> (https:\/\/moatline.io\/feeds\/exploited.json<\/code>)<\/p>\n\n\n- What it's used for: warning you when a plugin or theme installed on your site has a security hole that attackers are exploiting right now.<\/li>\n
- What is sent: nothing about your site. The whole list (a small file) is downloaded about twice a day and compared on your own site. Like any web request, it reveals your server's IP address to moatline.io.<\/li>\n
- Provided by Next Nova Technologies, the makers of this plugin: Terms of Service<\/a> and Privacy Policy<\/a>.<\/li>\n<\/ul>\n\n
If your server cannot reach moatline.io, the copy of the list included with the plugin is used.<\/p>\n\n
Credits<\/h3>\n\n