Diagnose, treat and immunize your WordPress
Scan any WordPress site free in seconds. Clean malware with AI that backs up first and rolls back on its own if anything breaks — with 24/7 monitoring.
Public, read-only. Internal analysis requires proof that you own the site.
Sign up for free to save your history.
%
Of the web runs on WordPress
24/7
Automated monitoring and alerts
d
Reversible backups, up to (by plan)
Last scan
Just now
🎉 Now officially on the WordPress.org Plugin Directory
Reviewed and published in the official WordPress.org repository.
The clinic for your WordPress
WP Clinic works like a full medical checkup for your site: it diagnoses what's wrong, treats the infection, and leaves your site immunized against the next one.
The passive scan is read-only and works on any domain, no strings attached. Active access — AI repair, off-site backups, daily monitoring — only unlocks once you prove you own the site, by installing the free plugin.
24/7 monitoring
We alert you the moment something looks off
Security capabilities
Everything the clinic does for your WordPress's health, end to end
Whole-account scan
Checks every file across your hosting, not just the WordPress folder, looking for webshells and backdoors with deterministic signatures — without spending a single AI token.
AI-powered repair
Every file gets an off-site backup before anything is touched. The AI applies the patch, runs a health check on the live site, and rolls everything back on its own if something breaks.
One-click hardening
Security headers, XML-RPC control, user-enumeration blocking and more — all reversible, all applied deterministically.
- HSTS / CSP headers
- Native hidden login
- XML-RPC blocking
Off-site backups
Every repair is backed up off your server before anything is touched, verified with a SHA-256 hash before restoring.
- Retention from 15 to 180 days
- Out of malware's reach
- One-click restore
Safe updates
WordPress, plugins and themes update themselves, with backup, health checks and automatic rollback at every step.
- PHP/WP compatibility gate
- Included on the Free plan
- Neutralizes nulled plugins
How it works
A full medical checkup for your WordPress: from diagnosis to immunity
From diagnosis to immunization
Scan free in seconds. Install the plugin whenever you want active protection. From there, WP Clinic watches, repairs and shields your site every day, with nothing left for you to do.
See all features
Safe updates
Auto-update with backup and rollback
WordPress hosting
Included from the Advanced planNative hardening
Hidden login and security headersFull visibility
Activity log + Site HealthPRICING
Plans that grow with your sites
Free scans forever. AI repair, deep scans and backups on paid plans.
- Unlimited passive scans
- 1 verifiable domain
- Free AI (BYOK)
- Cloud reversibility backups
- 5 sites
- 25 AI file cleans / month
- 200 MB shared storage (backups + cloud quarantine)
- Weekly autoscan
- Free AI (BYOK)
- Cloud reversibility backups
- Unlimited sites
- 25 AI file cleans / month
- 200 MB shared storage (backups + cloud quarantine)
- Weekly autoscan
- Free AI (BYOK)
- Cloud reversibility backups
- 20 sites
- 100 AI file cleans / month
- 5 GB shared storage (backups + cloud quarantine)
- WordPress hosting
- Daily autoscan
- Free AI (BYOK)
- Cloud reversibility backups
- 50 sites
- 250 AI file cleans / month
- 10 GB shared storage (backups + cloud quarantine)
- WordPress hosting
- Daily autoscan
- Free AI (BYOK)
- Cloud reversibility backups
- 250 sites
- 500 AI file cleans / month
- 20 GB shared storage (backups + cloud quarantine)
- WordPress hosting
- Daily autoscan
- Free AI (BYOK)
- Cloud reversibility backups
- 500 sites
- 1250 AI file cleans / month
- 50 GB shared storage (backups + cloud quarantine)
- WordPress hosting
- Daily autoscan
- Free AI (BYOK)
- Cloud reversibility backups
Compare plans
Every feature, side by side. Swipe to see all plans.
| Feature | FreeFree | Basic$8/mo | Designer$15/mo | Advanced$15/mo | Professional$30/mo | Enterprise$50/mo | Datacenter$100/mo |
|---|---|---|---|---|---|---|---|
| Sites | 1 | 5 | Unlimited | 20 | 50 | 250 | 500 |
| Scans per day (website) | 5 | 10 | 10 | 20 | 30 | 50 | 100 |
| Scans per day (WP Plugin) | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Free instant scan | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| CVE & outdated alerts | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| PHP upgrade advisor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Whole-hosting deep scan | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| AI malware cleanup | Free AI (BYOK) | 25 credits/mo Free AI (BYOK) | 25 credits/mo Free AI (BYOK) | 100 credits/mo Free AI (BYOK) | 250 credits/mo Free AI (BYOK) | 500 credits/mo Free AI (BYOK) | 1250 credits/mo Free AI (BYOK) |
| AI file cleans / month | ✗ | 25 | 25 | 100 | 250 | 500 | 1250 |
| AI rescans / repaired site | ✗ | 3 | 3 | 3 | 6 | 12 | 24 |
| Nulled-plugin neutralizer | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 24/7 monitoring with email alerts | ✗ | Weekly | Weekly | Daily | Daily | Daily | Daily |
| Shared storage (backups + cloud quarantine) | 50 MB | 200 MB | 200 MB | 5 GB | 10 GB | 20 GB | 50 GB |
| Off-site encrypted backups | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Online quarantine (Cloud) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| WordPress hosting | ✗ | ✗ | ✗ | 5 GB | 10 GB | 20 GB | 50 GB |
| Safe auto-updates | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cleanup (unused files & DB junk) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cloud retention | 15 days | 15 days | 15 days | 30 days | 90 days | 6 months | 6 months |
Need more room? Add 100 GB to your storage pool for $5/mo on any plan.
Security you can trust
This is how WP Clinic protects your site without putting your data at risk
Frequently asked questions
Everything you need to know about scanning, AI repair, hardening and plans.
Is the scan really free?
Yes. The passive scan is free forever — no signup, no credit card, no time limit. You just enter a WordPress URL and get a read-only security report.
Do I need to install anything?
Not for the free scan — it only reads what's publicly visible. A whole-hosting deep scan and AI repair need the free WP Clinic plugin installed on your own site, and only run after you prove you own it.
How does the AI malware cleanup avoid breaking my site?
Every repair takes a full backup first, applies an audited patch, then runs a health check on the live site. If anything looks broken, it automatically rolls back to the pre-repair backup.
What's the difference between the free scan and a deep scan?
The free scan is a read-only look from the outside: WordPress detection, plugin and theme versions, and known CVEs. A deep scan runs through the installed plugin and inspects every file across your whole hosting account — including webshells and backdoors outside WordPress itself.
Which plugins and versions do you check for vulnerabilities?
Every plugin and theme actually detected on the site, matched by its exact installed version against public CVE and vulnerability databases — plus a PHP compatibility check that tells you the highest PHP version your code base supports.
How do payments work?
Paid plans are a monthly subscription billed automatically to a card. No WordPress account, app store, or manual renewal is required.
Does WP Clinic scan outside WordPress?
Yes — a deep scan checks your entire hosting account, not just the WordPress folder, since webshells and backdoors are often planted in unrelated files or folders that share the same account.
What happens to PHP files found in my uploads folder?
PHP with real code doesn't belong in uploads, so WP Clinic backs it up off-site and quarantines it automatically. The action is fully reversible with one click, and known harmless guard files (like WordPress's own index.php) are never touched.
Can WP Clinic hide my wp-admin login?
Yes. WP Clinic can move your login to a secret address of your choosing, natively — no third-party plugin. It's lockout-proof: the URL is always shown in your dashboard, with a one-click disable and an FTP rescue switch.
Will hardening break my site, and can I undo it?
Hardening fixes are deterministic and reversible — headers, XML-RPC control, user-enumeration blocking and the rest can each be turned off individually. Once applied, a fix stays applied and won't keep reappearing in your alerts.
Does WP Clinic update WordPress core safely?
Yes. Core, plugin and theme updates are all backed up first, health-checked after, and automatically rolled back if anything breaks — and a compatibility gate blocks any update that needs a higher PHP or WordPress version than your site runs.
How do backups and restores stay safe from malware?
Backups are stored off-site, outside the reach of anything compromised on your server, with no storage credentials ever kept on your site. Every restore is downloaded over TLS and verified with a SHA-256 hash before it's applied.
Can I see a history of everything WP Clinic did?
Yes — the Activity log is a full, downloadable audit trail of every detection, repair, backup, rollback, hardening change and update, in order.
Can I use AI repair for free?
Yes — connect your own free API key (Gemini, Groq or Cerebras) and AI malware cleanup runs at no charge, on every plan including Free. Paid plans also include a monthly credit allowance, so having your own key is optional, not required.
How do I get a free Gemini, Groq or Cerebras API key?
Gemini: aistudio.google.com/app/apikey. Groq: console.groq.com/keys. Cerebras: cloud.cerebras.ai. All three offer a free tier with no credit card. Paste the key into your WP Clinic dashboard or plugin — it's encrypted, used only to call that provider's API for your repairs, and never sent anywhere else.
What happens to my code when I use my own AI key?
Only the specific infected file content is sent to your chosen provider (Gemini, Groq or Cerebras) to generate a cleanup patch — never your whole site, never your database, and nothing is stored afterward. The same backup, health-check and auto-rollback safety net applies whether the repair used your key or a plan credit.
What's the Designer plan?
Designer has the same features as Basic — AI repair credits, weekly autoscan, storage pool — priced like Advanced, but with unlimited sites. It's built for agencies and freelancers managing many client WordPress installs.
Is off-site storage shared between backups and other features?
Yes — every plan (including Free) has one storage pool covering off-site backups and Cloud quarantine, sized to the plan. Need more room? A 100 GB add-on is available for $5/mo on any plan.
Is Online quarantine (Cloud) available on every plan?
Yes — Cloud quarantine (an off-site copy of anything Cleanup quarantines) is available on every plan now, limited only by your storage pool, not by price.
Which plans include WordPress hosting?
Hosting is included from the Advanced plan and up (Advanced, Professional, Enterprise, Datacenter). Free, Basic and Designer don't include hosting.
Professional-grade security, every day
Deterministic malware signatures plus AI for cleanup. Backup, health check and automatic rollback on every repair. Free to start, no surprises later.
Advanced technology
Deterministic malware signatures combined with AI (Gemini, Claude, Groq or Cerebras) for targeted cleanup.
24/7 availability
Daily or weekly monitoring depending on your plan, with bilingual alerts the moment something looks off.
Every platform
Automatically detects WordPress, Joomla, Laravel or a plain PHP site, no configuration needed.
Need help right now?
Our AI repair is ready to act on a compromised site.