You run a scan, it comes back clean, and you feel better. Fair enough. But a clean scan means something narrower than most people assume, and the gap between "the scanner found nothing" and "the site is fine" is where a lot of long-running infections live.
Here is what these tools actually do.
How a scanner decides something is malware
Two main methods, and they fail in different ways.
Signature matching. The scanner has a database of code fingerprints from known malware and compares your files against it. Fast, accurate, and completely blind to anything not already in the database.
Heuristics. Instead of matching exact code, it looks for suspicious behaviour and patterns: heavily obfuscated code, functions that execute arbitrary strings, a PHP file sitting in your uploads folder where only images belong. This catches new threats, and it also produces false alarms, because some legitimate plugins genuinely do write ugly code.
Good scanners also compare your WordPress core and repository plugin files against the official versions. That comparison is very effective, because it tells you exactly which files have been modified from what they should be.
What a scan reliably catches
- Modified core, plugin or theme files, when the original is available to compare against.
- Known backdoors and web shells, the files that let an attacker return after cleanup.
- Injected spam links and hidden SEO content in posts and pages.
- Redirect code planted in .htaccess or index.php.
- Unexpected PHP files in directories that should never contain them.
- Known-vulnerable plugin and theme versions still installed on the site.
For the common automated infections, which is the overwhelming majority of what hits small business sites, this covers a lot of ground.
What it misses, and this is the important half
Malware in the database. Many scanners only read files. Injected scripts and spam can sit in your posts table, your options table, or in widget content, and a file-only scan walks straight past it.
Custom code with nothing to compare to. If your theme was built bespoke for you, there is no official version to diff against. Malicious code added to a custom theme file is far harder to detect automatically.
Anything genuinely new. A brand new attack has no signature yet. There is always a window.
Attacks that use legitimate access. If someone logs in with a stolen password and changes a page, no file was modified and no malware was installed. A scanner sees a normal edit by a normal user.
Malware living outside your site. Compromised hosting, a poisoned DNS record, or a hacked third-party script you load from elsewhere. Your files are clean. Your visitors are not safe.
Conditional payloads. Sophisticated malware only activates for certain visitors, often people arriving from search on mobile. It hides from logged-in users, and sometimes from scanners too.
The failure that costs the most: nobody reads the result
Here is the pattern that turns a small problem into a large one. The scan runs weekly. It emails a report. The report goes to an address nobody checks, or lands in a folder with three hundred others, or reads "12 issues found" with no indication of whether that means catastrophe or a false positive about an old plugin.
The scan worked perfectly. The infection stayed for eleven weeks anyway.
A scanner detects. It does not decide, it does not clean, and it does not care whether you noticed. Detection without a human acting on it is just very well-organised record keeping.
The fix: for every scanning tool you have running, answer two questions. Where does the alert go, and who is responsible for acting on it? If either answer is vague, the scanning is decorative.
How to get more out of scanning
- Use more than one scanner occasionally. They have different databases and catch different things.
- Check from outside as well as inside. An external scan sees what visitors see, including conditional redirects your own browsing never triggers.
- Watch Google Search Console for security notices. It is free and it is often the earliest external signal.
- Do the manual checks a scanner cannot: log out, search your domain on Google, load your site on mobile data, read your admin user list.
- Keep backups from before any suspected infection, so a clean restore point exists.
Scanning is a starting point, not a service
Malware scanning and 24/7 uptime monitoring run on every Up Speed plan, including Starter, along with scheduled off-site backups and tested updates. But the scan is not the product. The care SLA is: when something turns up, we investigate it and fix it rather than forwarding you an alert.
If you want more layers around the scanning, the Professional plan adds the Wordfence firewall, iThemes hardening, two-factor login and blacklist monitoring through Google Safe Browsing, which covers the case where Google spots a problem before your own tools do.
No scanner finds everything, and we will not claim ours does. What we can say is that a result nobody reads is worth nothing, and that is the part we take off your desk.