Cómo escanear tu sitio WordPress en busca de malware (gratis)

If you run a WordPress site, "is it currently infected?" is a question worth answering regularly — not just after something looks wrong. A malware scan checks your site against known attack patterns and outdated software, the two most common ways WordPress sites get compromised.

1. Ejecuta el escaneo pasivo gratis

WP Clinic's free scan needs no account and no installation. Go to the free scanner, enter your site's URL, and submit. The scan reads only what's already publicly visible on your site — the same information a visitor's browser or a search engine sees — so it's safe to run against any WordPress site, including ones you don't own.

In seconds you get a report covering:

• Versión del núcleo de WordPress, y si está desactualizada
• Plugins y temas instalados que puede detectar, comparados con CVEs conocidos
• Archivos sensibles expuestos (backups de configuración, logs de depuración, etc.)
• La URL real de inicio de sesión del sitio, incluidas rutas de login ocultas o personalizadas
• Problemas de versión de PHP que afectan la seguridad o la compatibilidad

2. Lee los resultados

Findings are grouped by severity. Outdated plugins or themes with a known CVE are the most urgent — update them first, since public vulnerability databases mean attackers can find and target that exact version too. Exposed files and unusual login paths matter but aren't proof of an active infection by themselves.

3. Profundiza si algo parece raro

A passive scan can only see what's public. It can't read your files, database, or anything behind login — which is exactly where malware, webshells and backdoors usually hide. To check those, install the free WP Clinic plugin on your own site and run a deep scan. It inspects every file across your whole hosting account (not just the WordPress folder — malware outside WordPress can still reinfect it), looking for malware signatures, webshells, PHP dropped into your uploads folder, injected posts, suspicious admin accounts and nulled (pirated) plugins carrying backdoors.

4. Si encuentras algo

Paid plans add AI-powered repair: WP Clinic takes a full backup first, applies an audited patch to remove the malware, then runs a health check on the live site. If anything looks broken afterward, it automatically rolls back to the pre-repair backup. See our guide on cómo limpiar un sitio WordPress hackeado de forma segura for the full process.

¿Con qué frecuencia debería escanear?

A one-off scan is a snapshot — new vulnerabilities are disclosed constantly, so a plugin that's safe today can be exploitable next month. Registering a free account lets you save scan history; paid plans add 24/7 monitoring with email alerts, so you find out the moment something changes rather than the next time you happen to check.