The best WordPress plugins for virus protection. The only working antivirus for WordPress Antivirus plugin for wordpress

WordPress is one of the most popular content management systems (CMS) used by people either for simple blogging or for other purposes such as creating an online store. There are many plugins and themes to choose from. Some of them are free, some are not. Often these themes are downloaded by people who have customized them for their own benefit.

1. Theme Authenticity Checker (TAC)

Theme Authenticity Checker (TAC) is a WordPress plugin that scans the source files of each installed WordPress theme for hidden footer links and Base64 codes. Once detected, it displays the specific theme path, line number, and a small piece of malicious code, allowing the WordPress administrator to easily analyze this suspicious code. [Download ]

2.Exploit Scanner

Exploit Scanner is able to scan your site's files and database and is able to detect the presence of anything questionable. When using Exploit Scanner, keep in mind that it will not help prevent a hacker attack on your site and will not remove any suspicious files from your WordPress site. It is there to help identify any suspicious files uploaded by a hacker. If you want to delete them, you will need to do it manually. [Download ]

3. Sucuri Security

Sucuri is a well-established malware detection and security plugin in general. Sucuri's main features are monitoring files uploaded to a WordPress site, blacklist monitoring, security notifications, and more. It also offers remote malware scanning with the free Sucuri SiteCheck Scanner. The plugin also provides a powerful site firewall addon that can be purchased and activated in order to improve the security of your site. [Download ]

4.Anti-Malware

Anti-Malware is a WordPress plugin that can be used to scan and remove viruses, threats, and other malware that may be present on your site. Some of its important features offer customized scans, full and quick scans, automatic removal of known threats. The plugin can be registered for free at gotmls . [Download ]

5.WP Antivirus Site Protection

WP Antivirus Site Protection is a security plugin for scanning WordPress themes along with other files uploaded to your WordPress site. The main functions of WP Antivirus Site Protection are scanning every file uploaded to the site, updating the virus database on an ongoing basis, removing malicious code, sending notifications and alerts by email, and much more. There are also features that you can pay for if you want more “tightened” security for your site. [Download ]

6. AntiVirus for WordPress

AntiVirus for WordPress is an easy-to-use protection plugin that will help you scan the WordPress themes used on your site for malicious code. Using this plugin, you will be able to receive virus notifications in the admin panel. There is also a daily scan, according to the results of which you will receive an email if anything suspicious is found. [Download ]

7. Quttera Web Malware Scanner

The Quttera Web Malware Scanner will help you scan the site and protect it against the introduction of malicious code, viruses, worms, trojans and other computer evil spirits. It offers several interesting features such as scanning and detection of unknown malware, blacklisting, scanning engine with "artificial intelligence", detection of foreign external links and much more. You can scan your site for malware for free, while other services cost $60/year. [Download ]

8.Wordfence

If you are looking for a way to protect your site against cyber attacks, then you should try the Wordfence plugin. It provides real-time protection against known attacks, two-factor authentication, blocks the entire infected network (on detection), scans for known backdoors, and many other things. The services mentioned are free, but other features are offered for a fee. [Download ]

CMS WordPress is a well-protected system, but vulnerabilities can be found in any system. WordPress developers are trying to make CMS security more robust with each new release, but attackers are not sitting idly by either. Therefore, to protect your site from hacking, viruses and attacks, you will have to take some measures yourself.

I can give you some practical WordPress security tips to help you. protect your WordPress site from basic threats, viruses and attacks.

Basic WordPress Security Measures

Protecting WordPress from basic threats is not difficult, all you need to do is take some steps. In order to simplify the task, I recommend using the "Better WP Security" plugin.

After installing and activating the plugin on WordPress, go to your site's admin area to the "Better WP Security" settings page, and back up your database, just in case.

Then, in order to allow the plugin to make changes to your site and engine files, you must give permission by clicking on the appropriate button.

On the next page, in order to protect your site from basic attacks, you must enable this option by clicking on the corresponding button.

But that's not all. After you fulfill the first requirements of the plugin, a table will open in front of you, which will indicate all the potential vulnerability points of your site. To protect your WordPress site, you need to fix all security flaws.

Troubleshooting WordPress Vulnerabilities

You will see approximately the following table of vulnerabilities, in which critical vulnerabilities are highlighted in red, and non-critical vulnerabilities are highlighted in yellow and blue, but they also need to be fixed.

For example, I took a standard insecure WordPress blog. Let's fix all the known vulnerabilities in WordPress together.

1. Check password complexity for all users

In order to provide strong passwords for all users, you need to fix the first vulnerability. Follow the link "Click to fix" and on the page that opens, select the item as in the picture below "Strong Password Role - Subscriber". Thus, the passwords of all your users will pass the complexity check.

2. Removing Additional Information from the WordPress Header

WordPress by default publishes a lot of additional information in the header of the site, which can be exploited by attackers. To delete such information, check the corresponding box. But be careful, this action may result in the inoperability of some applications and services that somehow access your blog via the XML-RPC protocol.

3. Hide updates from non-administrators

The third point is fine with us, if you are not, then I recommend that you hide the available updates from non-administrators. This information will still be useless to your users, but attackers can use it.

4. Change administrator login

The default WordPress admin account is admin, and everyone knows this. Therefore, your site is easier to hack. In order to complicate the hacking of the site, I recommend renaming your administrator account. To do this, follow the link "Click here to rename an administrator" and enter a new administrator name in the appropriate field.

5. Change Admin ID

By default, the administrator account is also assigned ID=1, which is also known to attackers, so this parameter needs to be changed. The better wp security plugin will change the admin ID in one click.

6. Change WordPress Database Table Prefix

By default, WordPress database tables are prefixed with wp_. It is recommended to change the prefix to any other. Even if your database is already filled with information, the better wp security plugin will change the prefix of your database tables without losing data. It is recommended to make a database backup before this action, which we did at the very beginning.

7. Plan your backups

To create a regular backup of your database, set some conditions and enter your e-mail where the database copies will be sent. Thus, you can restore the database from a copy at any time, if necessary.

8. Deny access to the admin panel at a certain time

This parameter is not critical, but, nevertheless, if you are worried about the security of your WordPress site, then it is probably worth disabling chaotic access to the admin panel, and only allow access at certain times, for example, at the time when you are going to work with the site.

9. Block suspicious hosts

If you know the IP addresses of suspicious hosts from which an attack on your site can be made, then add these IP addresses to the ban list, and access to the site from these IPs will be closed.

10. Protect login from brute force

By default, the plugin protects the login from brute force and blocks the IP address after 3 unsuccessful attempts.

11. Hide WordPress Admin

This point is not critical, but it will still be useful to hide the WordPress admin area. Hiding the WordPress admin area is done by renaming the directory with the admin panel. Physically, the admin panel will be in the same folder, but it will not be available at http://your_site.ru/wp-admin.

Hide the WordPress admin panel by entering new directory names in the appropriate fields and checking the box to enable this option.

12. Protect .htaccess file and hide directories from view

I recommend that you hide the site directories from free browsing, and also protect the .htaccess file. You can also disable various requests to the site through the address bar. I remind you that these actions may cause conflict with some plugins and themes.

18. Disable writing wp-config.php and .htaccess files

Some of the items were completed by default, so I suggest you complete the most important item 18 of the protection, which will help prevent overwriting of the wp-config.php and .htacces files. This point is very important, because the performance of your site may depend on the safety of the wp-config.php and .htacces files.

20. Rename content folder wp-content

You can also rename the folder with the main content of the wp-content site. Non-standard placement of files will make it more difficult for attackers to access them.

Hello friends. Today we will talk about the security of our business on the Internet. Anything happens in life and our resources are not immune from various troubles and surprises. Information is intangible, so it can easily be corrupted or destroyed. There are risks associated with the equipment on which the sites are hosted, somewhere we ourselves can “screw up”, and no one is immune from the malicious intent of outsiders.

During my blogging, I have come across the first and the second and the third. And hackers broke my sites and sometimes did something wrong. But, fortunately, everything worked out thanks to pre-organized protection.

I use several plugins on my blog to help mitigate risks. I will tell you about them now. I already talked about the first one, and I cover the other 2 for the first time.

Security plugins for WordPress

Of course, wordpress protection can be organized in other ways and plugins, but I use these. I will not talk about installing plugins, since already (find the necessary video lesson in the article) I will only show how to configure them.

1. WordPress Database Backup Plugin

This plugin allows you to backup your website database both automatically and manually. You can download them directly to your computer or email them to yourself. In order for you to understand better. This plugin completely preserves the informational part of the site - texts, their design, data about users and other components of the site, but it does not save the files themselves. You should save pictures and themes yourself.

This plugin does not have to be downloaded to your computer, it is in the database of plugins for wordpress, so it is easy to install through the admin panel, through the search for plugins.

Video tutorial on setting up WordPress Database Backup

If it is not convenient for you to watch the video, I will duplicate the setting with text and screenshots.

How to Install WordPress Database Backup

To get started, go to the admin panel of your blog in the plugin installation section and select the plugin search section. In the search box, type "wp db backup".

In the list of plugins, it should appear in the first place, if not, then scroll down a little. The name of the plugin will be the install button. Use it to install the plugin. After installation, click on the link to activate.

After that, we proceed to its settings. To do this, in the blog control panel, you need to find the tools tab and the Backup link in it. Click on it.

What tables to keep?

At the beginning of the setup, we are asked to select those database tables that will be copied. Among them are those that are always saved and those that we can save additionally. Even if you leave everything by default, it will be fine. If you understand what these or other tables mean and what functions they perform, put the necessary checkmarks.

Saving a copy "here and now"

The next item "Backup settings" is responsible for backing up "here and now". This is the same manual mode when we can backup the database right now. By and large, all we can configure here is a place to save the backup. The first item saves the file on the hosting provider's server. The second point downloads it to your computer. The third option allows you to send by email.

The "create archive" button starts saving.

If you need to make an urgent copy, for example, before a big site change, then use this function.

Scheduled backup

Scheduled database backups with the WordPress Database Backup plugin are exactly what I love about it. In life, you are constantly spinning in business and because of the hustle and bustle you can forget to do something, or simply there is not enough time. And with the help of this function, the site itself does everything at a given frequency.

You can set up copying at different time intervals from one hour to twice a month. It all depends on how often you add new posts to the site. If you write often, back up more often, and if you have one article a week, then once a week is enough.

In addition, there is a separate list of saved tables for automatic copying. In a word, specify the frequency, select the necessary tables, indicate your mailbox where the copies will come, and click "remember the schedule".

This completes the setup of this plugin. Let's move on to the next one.

2. Plugin to protect the admin panel Login LockDown

Before I talk about setting up the plugin, I want to give one recommendation related to the same topic. Don't use the default admin login that wordpress gives you as it's easy to guess. If you have a login different from the standard one, it will be much more difficult to access the admin panel.

Installing and configuring the Login LockDown plugin

As in the case of the previous plugin, Login LockDown is in the WordPress database, so it is also installed through the plugin search. Find, install, activate.

After that, through the parameters tab, go to Login LockDown

There are several fields in which the values ​​of all parameters are set by default.

Basically, you can't change anything. If you want to customize the plugin for yourself, then the fields mean the following:

Max Login Retries - the maximum number of attempts to enter a login / password before blocking. If 3 is specified and you entered the wrong password 3 times, the admin panel is blocked.

Retry Time Period Restriction (minutes)- the time for which the admin panel is blocked if the password is entered incorrectly.

Lockout Length (minutes) - the time for which the admin panel is blocked when the maximum number of invalid login entries is allowed. Please note that an invalid login is being tracked here. That is, the one who enters the data does not know the login.

Lockout Invalid Usernames? – enable or disable the strong blocking from the previous paragraph.

Mask Login Errors? – whether or not to hide the message that the login was entered incorrectly.

Set the values ​​​​you need and press the confirmation button - Update Setting.

3. Plugin for wordpress - AntiVirus

The name of this plugin speaks for itself. It looks for viruses and various spyware in your site's template code. It does not have such fancy functionality as antivirus programs for personal computers. AntiVirus works very simply - it scans files and, if it finds suspicious codes, reports them to the owner via e-mail and in the admin panel.

It cannot automatically protect wordpress files, you yourself must check everything that it suspected and either leave it or delete it.

Installing and configuring AntiVirus

By tradition, we enter the search for plugins through the admin panel. It is in the wordpress database, so it is installed quickly and easily.

It doesn't require any settings. And it starts working immediately after activation. The only thing you can do with your hands is to instantly crawl your site. To do this, after activation, you need to open the AntiVirus tab in the administrator panel. There will be a button "Scan the Theme Templates now" - it starts an instant scan.

Also, on this page, you can specify the mailbox to which the plugin will send messages. If this is not done, all emails will be sent to the site administrator's address.

All suspicious codes are highlighted in the scan results. But you do not need to immediately rush to remove them. Suspicious does not mean malicious. Every element is worth checking out. If you understand php, it will not be difficult for you to figure out the problem.

But if you are not an expert in programming (I am not an expert either) - do not despair. You can simply compare the files that AntiVirus flagged as suspicious with your template's source files - they must either be on your computer or on the theme creator's official website. If these parts of the code are in the original, then everything is in order.

You need to confirm each checked element by clicking the “There is no virus” button - the plugin will no longer perceive this element as suspicious.

Like all additional plugins for wordpress, AntiVirus loads the server and slows down the site, so I recommend not keeping it active all the time, turn it on periodically to check.

Summary

Protecting wordpress isn't really that hard. Of course, there is no way to insure 100% of all cases in life - hackers are constantly finding new loopholes, and you stumble upon new solutions to problems, but a few precautions and a few useful plugins will allow you to sleep peacefully without worrying about the work of your site.

Using a security plugin protects your WordPress site from malware, attacks, and hacking attempts. This article contains the best WordPress security plugins that are recommended to use to secure your site.

Why Use a WordPress Security Plugin

Every week, about 18.5 million websites are infected with malware. The average site is attacked 44 times every day, including WordPress and other CMS websites.

A security breach on your website can cause serious business damage:

• Hackers can steal your data or data belonging to your users and customers.
• A hacked website can be used to distribute malicious code, infecting unsuspecting users with it.
• You may lose data, lose access to your website, the site may be blocked.
• Your site may be destroyed or damaged, which can affect SEO rankings and brand reputation.

You can scan your WordPress site for security breaches at any time. However, cleaning up a hacked WordPress site without professional help can be quite difficult for novice webmasters.

To avoid being hacked, you must follow site security guidelines. One of the important steps to secure your WordPress site is to use a security plugin. These plugins help simplify WordPress security and also block attacks on your site.

Let's take a look at some of the best WordPress security plugins and how they protect your site.

Note!

Note. You only need to use one plugin from this list. Having multiple active security plugins can lead to errors.

Note. You only need to use one plugin from this list. Having multiple active security plugins can lead to errors.

1. Sucuri

Sucuri is the leader in WordPress security. The developers offer a basic free plugin, Sucuri Security, which helps you harden your security and scans your site for common threats.

But the real value lies in the paid plans that come with the best WordPress firewall protection. A firewall helps block malicious attacks while accessing WordPress.

The Sucuri Internet Firewall filters out bad traffic before it reaches your server. It also serves static content from its own CDN servers. Security aside, their DNS level firewall with CDN gives you an amazing performance boost and speeds up your site.

Most importantly, Sucuri offers to clean up your WordPress site if it gets infected with malware at no additional cost.

See also:

2.Wordfence

Wordfence is another popular WordPress security plugin. The developers offer a free version of their plugin that comes with a powerful malware scanner. The plugin detects and evaluates threats.

The plugin automatically scans your site for common threats, but you can also run a full scan at any time. You will be alerted if any signs of a security breach are found. You will also receive instructions on how to fix them.

Wordfence comes with a built-in WordPress firewall. However, this firewall is running on your server before loading WordPress. This makes it less effective than a DNS layer firewall like Sucuri.

3.iThemes Security

iThemes Security is a WordPress security plugin from the developers of the popular BackupBuddy plugin. Like all their products, iThemes Security offers a great clean user interface with tons of options.

It comes with file integrity checks, security hardening, login attempt restrictions, strong password enforcement, 404 error detection, attack protection, and more.

iThemes Security does not include a website firewall. It also doesn't include its own malware scanner, but uses the Sitecheck Sucuri malware scanner.

4. All In One WP Security

All In One WP Security is a powerful WordPress security checker, monitoring and firewall plugin. It makes it easy to apply basic WordPress security best practices to your website.

The plugin includes login blocking features to prevent attacks on your site, IP address filtering, file integrity monitoring, user account monitoring, scanning for suspicious database input patterns, and more.

It also comes with a basic website-level firewall that can detect and block some common patterns. However, it is not always effective and you will often have to manually blacklist suspicious IP addresses.

5. Anti-Malware Security

Anti-Malware Security is another useful WordPress anti-malware and security plugin. The plugin comes with actively maintained definitions that help you find the most common threats.

The plugin allows you to easily scan all files and folders on your WordPress site for malicious code, backdoors, malware, and other known malware attack patterns.

The plugin requires you to create a free account on the plugin's website. After that, you will have access to the latest definitions, as well as some premium features such as attack protection.

Nuance: while the plugin does rigorous tests, it often shows a high number of false positives. Coordinating each of them with the source file is a rather painstaking work.

6 BulletProof Security

BulletProof Security isn't the prettiest WordPress security plugin on the market, but it's still useful with some great features. It comes with a setup wizard. The settings panel also includes links to extensive documentation. This will help you understand how security checks and settings work.

The plugin comes with a software scanner that checks the integrity of WordPress files and folders. It includes login protection, session timeout, security logs, and a database backup utility. You can also set up email notifications in security logs and receive alerts when a user is blocked.

It's funny sometimes things happen in life. I came across a cool course on Udemy on modern ways to protect and hack sites. Upgrading my skill level, I missed the virus infection of my blog. Most likely, WordPress users have experienced the symptoms in one way or another, which I will describe next. If not, then you are lucky. I myself didn’t attach anything to sites for a very long time, thinking about how they still manage to infect their web resources. Back in 2014, I was surprised by messages on the forums that their site with an excellent attendance was simply infected and taken away.

And so, this morning, a letter arrived in the mail from my hoster, which puzzled me. Yes, I was pleasantly surprised that ihc monitors sites for malware, but the message that one file was changed at night without my knowledge and this suspicion of virus activity caused chaotic emotions. In fact, it was confirmation of my suspicions.

Some time ago, I discovered that the metric has clicks to sites that I simply can’t write in my posts. When I tried to find these links stupidly through the blog search engine, I was redirected to Apache with an error message. Even then, suspecting something was wrong, I got into the file search.php active topic, in which I saw obfuscated code. Then it put me in a stupor, but due to lack of time, I did not delve further. As it turned out in vain. After all, this was one of the signs of infection.

An example of coded malware

I foolishly relied on the means of detecting malicious code from various services that litter the Internet. All of them "joyfully" informed me that the site was clean as morning dew.

Imagine a paradoxical situation - there is a non-working search function, there is an obfuscated php code so that the unlucky webmaster does not see the "gift", and anti-virus services are simply silent.

But back to our sheep, more precisely, to the sites. On all these sites I have two-level authorization. Maybe this saved the site from being taken away by a hacker. Two days after being infected search.php I received a notification from ihc.ru that some files have been changed and if I did nothing, it is recommended to check with the antivirus provided by the hosting itself. Well, now the opportunity to test this antivirus has turned up, it’s a pity that my favorite site got as a test subject 🙁

The result of the check, to put it mildly, rather puzzled me. Antivirus shoveled the site for about forty minutes and then sent its "verdict". 42 files were infected...

Here it was time to grab your head, thinking about how such a thing could have happened. It goes without saying that there was an exploit. But more about that later.

It was necessary to treat the site, but for this it had to be thoroughly investigated. Yes, it could have been done much easier - merge the database dump, transfer pictures from wp-content and re-upload all this to a freshly installed WordPress engine. But "easier" does not mean "better". In fact, without knowing what was changed, one would expect the hole to appear on the reuploaded site as well. And then it was just right to become a newly minted Sherlock Holmes in order to conduct a full audit of the site.

Finding malware is like being a detective

To be honest, I have not experienced such passion and interest for a long time. Yes, the hosting antivirus helped me in many ways, indicating in which files it found changes. But even he could not fully detect everything, since the code alternated with obfuscation and banal hex-coding using malicious js. It was necessary to do a lot with pens, using all third-party tools just as assistants.

So, we launch the code editor and look at the infected files. In fact, in the code they "fire" quickly enough due to their encryption. However, this is far from being the case everywhere. It happened that it was necessary to parse the php file code line by line and figure out what was wrong with it. I must say right away that it was with the theme files. In this case, the original theme files are very useful for comparison, if you are not sure exactly what this or that function is for (and a correctly written virus should inherit as little as possible).

But let's look at everything in order. I already posted a screenshot of the code obfuscated by the virus at the beginning of the article. Using the https://malwaredecoder.com/ resource, you can decode it into a digestible form and study it. In my case, some files contained the injection. We erase all this to hell.

However, sometimes you may come across a short code with an include. As a rule, they become infected index.php and wp-config.php. Unfortunately, I did not take a screenshot of such code, since at that time I did not plan to write an article. From this code, it was clear that this was the code for calling a specific file encoded through js. To decode the hexadecimal code, we will use the http://ddecode.com/hexdecoder/ service, with the help of which we will determine that the file is called at the address wp-includes/Text/Diff/.703f1cf4.ico(I omitted the full path, the essence itself is important). What do you think, is calling a simple icon file worth encoding, albeit relatively simple encoding? I think the answer is obvious and open this "icon" through the notepad. Naturally, this again turned out to be a fully encoded php. We delete it.

Having cleared the obvious files, you can move on to the not-so-obvious ones - the WordPress theme files. Here obfuscation is not used, you need to dig the code. In fact, if you do not know what the developer originally intended, then this task is very creative, although it can be solved quite quickly. If you haven't changed the theme code, it's easier to replace the infected files (the anti-virus identified them for sure) and move on. Or you can dig like me and find that very often such viruses are attributed to the file function.php absolutely left function, in which there will certainly be a code for accessing sql. In my case, it looks like this (formatting left unchanged):

$sq1="SELECT DISTINCT ID, post_title, post_content, post_password, comment_ID, comment_post_ID, comment_author, comment_date_gmt, comment_approved, comment_type, SUBSTRING(comment_content,1,$src_length) AS com_excerpt FROM $wpdb->comments LEFT OUTER JOIN $wpdb-> posts ON ($wpdb->comments.comment_post_ID=$wpdb->posts.ID) WHERE comment_approved=\"1\" AND comment_type=\"\" A ND post_author=\"li".$sepr."vethe". $comment_types."mes".$sepr."@".$c_is_approved."gm".$comment_auth."ail".$sepr.".".$sepr."co"."m\" AND post_password=\ "\" AND comment_date_gmt >= CURRENT_TIMESTAMP() ORDER BY comment_date_gmt DESC LIMIT $src_count";

Where this sample goes, we have already cleaned up. Therefore, we calmly look at which function this code is located in and delete this entire function - it was attributed to the malware. But, again, it is much easier and better to overwrite the entire file from the finished theme if you are afraid of breaking something.

Well, the final touch - check the number of site users. All my sites I have always led myself. Accordingly, there cannot and should not be any other users. However, given the infection, it is easy to guess that they will try to steal the site and create its own user with admin rights. In my case it turned out wp.service.controller.2wXoZ. We delete it.

A lot of work has been done, but is there an exhaust? Let's check again with an antivirus, which reports that no more viruses were found. Everything, the site is cured.

Results

As you can see, curing a site is quite simple, although time-consuming. After treatment, it is necessary to prevent such situations in the future. Here you need to take just a few steps:

1. Update WordPress itself to the latest version. It is possible that they used an exploit for an outdated engine.
2. Check all plugins. Delete all unnecessary ones (which you put on the "future" and do not use) and check the relevance of those already working. However, even downloading a plugin from the WordPress repository does not give you a guarantee that the plugin will be clean. Cases have become more frequent when they buy out this or that plugin, make malware out of it, and when updating on your site, you will encounter the same “joys” as I do. In my case, I was infected just like that.
3. Always check the subject. If public - update. Of course, it is better if you buy it on the same templatemonster, although this does not give 100% protection.
4. Don't neglect tools like Wordfence. Although the free version of the plugin is very, very limited, at least you will know what is suspicious on your site.
5. Once a month, do not be lazy to run the site through wpscan, to see what vulnerabilities appeared on it.
6. Pay attention to the root of the site. There may be a file index.html.bak.bak. This also indicates that you have an infected site (you can immediately edit index.php, it is 100% infected)
7. Do not trust public site antiviruses. There is little sense from them.

I tried to show by my example how you can cure a WordPress site. Antivirus on ihc.ru is just a malware scanner. But he also made things easy. Nevertheless, even if your hosting does not have such a service, you can identify and prevent infection using the above algorithm.