How to Scan a WordPress Theme or Plugin ZIP for Malware Before Installing

Installing a theme or plugin takes seconds. Cleaning up a hacked site can take days. That is why smart site owners check every ZIP file before it goes live. In this guide, you will learn how to scan WordPress plugins for malware (and themes too) before installing them, using free tools like VirusTotal, Wordfence and Sucuri SiteCheck, plus a few simple manual checks. No single tool catches everything, so we combine several layers.

Why You Should Scan WordPress Plugins for Malware

Most malware in themes and plugins does not announce itself. Instead, it hides and waits. For example, in September 2025 the Wordfence team described a campaign in “The Price of ‘Free'”. Tampered copies of premium plugins carried a hidden backdoor that stayed dormant until a special URL triggered it. Once active, it could switch off the Wordfence plugin itself.

So the risk is real, especially with files from unknown sources. If you are new to this topic, our guide on GPL vs nulled themes explains why a “GPL” label alone does not prove a file is clean.

What You Need Before You Start

You do not need to be a developer to scan WordPress plugins for malware. You only need a few free tools and some patience.

• The ZIP file you want to install, saved on your computer.
• A fresh backup of your live site. Follow our guide to back up WordPress with UpdraftPlus if you do not have one.
• A staging site, such as a staging copy from your host or a local WordPress install.
• A security plugin on the staging site. In this guide, we use Wordfence.

How to Scan WordPress Plugins for Malware: Step by Step

Follow these steps in order. The same process works for themes, so use it whenever you scan WordPress plugins for malware or check a new theme. Each layer catches different problems, so do not skip straight to installing.

Step 1: Upload the ZIP to VirusTotal

First, go to VirusTotal and upload your ZIP file. VirusTotal checks the file with many antivirus engines at once. According to its documentation, it accepts any archive that the 7z tool supports, and the files inside appear as bundled files in the report. The general upload limit is 650 MB.

However, a clean VirusTotal result is only a first filter. Antivirus engines are good at known threats in executable files. They are weaker at spotting custom PHP backdoors. Also, remember that uploaded files are shared with the security community, so never upload files that contain private data.

Step 2: Unzip and Check for Obfuscated Code

Next, unzip the file on your computer and look inside. Malware authors often hide their code with encoding tricks. On macOS or Linux, you can search the whole folder with one command:

grep -rnE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(|assert\(|create_function\(" .

On Windows, a code editor like VS Code can run the same search across a folder. Then, review every match carefully. We explain what to look for in the warning signs section below.

Step 3: Look for Unknown URLs and Odd Files

After that, list every web address inside the plugin:

grep -rhoE "https?://[a-zA-Z0-9./_-]+" . | sort -u

Most URLs will point to the developer, WordPress.org or well-known services. Be careful with short, random-looking domains or raw IP addresses. In addition, watch for PHP files in places they do not belong, such as image or font folders, and for files with misleading names like .ico or .png that contain PHP code.

Step 4: Install on a Staging Site

Now, install the theme or plugin on your staging site, never on your live store first. Activate it and click through the main pages. Then, check Users for any new administrator accounts you did not create.

Step 5: Run a Wordfence Scan

Next, run a full scan with Wordfence on the staging site. According to the Wordfence plugin page, the scanner checks for signatures of over 44,000 known malware variants, known backdoors, and heuristics of suspicious code. It can also compare core files, themes and plugins with their WordPress.org versions.

For extra coverage, open Wordfence > Scan > Scan Options and enable “Scan plugin files against repository versions for changes” and the theme version of that option. These checks are not part of the standard scan, as the Wordfence scan documentation explains. Keep in mind that the comparison only works for items hosted on WordPress.org. Premium products are not in that repository, so for them, the malware signatures and heuristics do the work. Also, free users receive new signatures after a 30-day delay.

Step 6: Check the Front End with Sucuri SiteCheck

Finally, if your staging site is publicly reachable, scan its URL with Sucuri SiteCheck. It visits the site like a normal user and looks for malware, spam, defacements and blocklist warnings. However, Sucuri itself notes that this remote scanner only sees what is visible in the browser, so it will not detect server-side backdoors. Use it as a final check, not your only one.

Scanner Comparison: Which Tool Checks What?

Warning Signs of Obfuscated or Malicious Code

Not every match from your search is malware. Many honest plugins use base64_decode() to handle images or API data, for instance. So look at the context. These patterns deserve a closer look:

• Nested decoding, such as eval(base64_decode(...)) or eval(gzinflate(base64_decode(...))).
• Very long strings of random letters and numbers on a single line.
• Code that runs input directly, for example passing $_GET, $_POST or $_REQUEST into eval() or assert().
• Hidden admin creation, such as calls to wp_create_user() or wp_insert_user() in a plugin that has no reason to add users.
• Code that disables security tools, such as renaming or deactivating other plugins.
• Remote requests to strange domains on every page load.

If you have a clean original copy, you can also compare the two folders file by file. On macOS or Linux, diff -r original/ download/ shows every difference.

What to Do If a Scanner Finds Something

1. Do not install it on your live site. Delete the file from staging.
2. Check the details. One engine flagging a file can be a false positive. Several engines, or a clear backdoor pattern, should not be ignored.
3. Get a clean copy. Download the file again from a trusted source or from the original developer.
4. If it already ran on a live site, restore your backup, change your passwords, and run a full security scan.

Tips to Scan WordPress Plugins for Malware More Effectively

• Scan every update, not just the first install. A new version is a new file.
• Use more than one tool. Each scanner covers different blind spots.
• Prefer recent versions. Old copies carry known security holes. In fact, the infected plugins in the Wordfence report were outdated copies.
• Keep good backups. A recent backup turns a disaster into a small delay.
• Remove what you do not use. Fewer plugins means fewer places for malware to hide.

For example, before installing a big theme like Betheme, run it through VirusTotal, test it on staging and scan it with Wordfence. It only takes a few minutes.

Frequently Asked Questions

Is a clean VirusTotal result enough?

No. VirusTotal is a useful first check, but antivirus engines can miss custom PHP backdoors. Combine it with a manual code search and a Wordfence scan on staging.

Does base64_decode always mean malware?

No. Many legitimate plugins use it. It becomes suspicious when it is combined with eval(), hides long encoded strings, or runs user input.

Can Sucuri SiteCheck scan a ZIP file?

No. SiteCheck scans a website URL from the outside. To check a ZIP, use VirusTotal and a manual review, then scan the installed site with a server-side tool like Wordfence.

Is the free version of Wordfence good enough?

It is a solid starting point with malware signatures and backdoor checks. However, free users receive new signatures after a 30-day delay, while Premium users get them in real time.

Final Thoughts: Always Scan WordPress Plugins for Malware

To sum up, there is no magic button that proves a file is safe. Still, a simple routine lowers the risk a lot: upload to VirusTotal, search the code, install on staging, run Wordfence and finish with Sucuri SiteCheck. Make it a habit to scan WordPress plugins for malware every time you install or update one, and keep a fresh backup ready.

Looking for themes and plugins to test? Browse our collection of GPL themes and plugins, and remember to scan before you install.