What the deep scan actually does
On CLEAN, PROTECT, and AGENCY, a site is connected with the Connector plugin (read-only pull) or SSH. The engine then:
- Discovers WordPress and inventories core, plugins, and themes as text.
- Computes SHA-256 (and MD5 where checksums require it) with a file-size cap.
- Compares core/plugin/theme files to local checksum databases when present.
- Runs a YARA subset (no libyara/CGO) and filename/heuristic signals: PHP in uploads, unexpected core PHP, obfuscation combos.
- Optionally scans the database for injected options, users, and persistence. Database scan is skipped if it fails; the filesystem report still completes.
- Records per-file errors such as
failed to hash wp-includes/load.php: permission deniedand continues.
That is the WordPress malware scanner. A match is evidence in the report. It is not a delete instruction.
FREE Scan is a different product surface
The public FREE Scan does not log into WordPress and does not read wp-content. It fetches the URL over HTTP, refuses loopback, RFC1918, link-local, CGNAT, and userinfo in the URL. Use it to see whether a site looks like WordPress and what the HTTP surface exposes. For malware in files, you need the deep scanner.
Integrity beats a single signature
Known-bad hashes help. So do YARA strings. The stronger signal on a stock core file is often modified vs official MD5, or PHP where WordPress should not put PHP (uploads, unexpected core paths). See how the engine treats the site as data.
Related: malware removal, hardening, FAQ.