Moatlineby Next Nova
Free WordPress plugin / Now on WordPress.org
Moatline Malware Scanner is a WordPress malware scanner and security plugin. It scans files and database content for the tricks modern infections use to hide and return after a cleanup. Built by a team that cleans up hacked WordPress sites for a living.
Free, no account or licence key needed. Scans report findings; you choose what changes.
Built to stop what others miss
01 The problem
Today’s WordPress infections are built to slip past traditional scanners, and to come straight back after a cleanup.
ClickFix
Injected scripts show visitors a fake CAPTCHA that tricks them into running malicious commands on their own computer.
How Moatline helpsThe scanner flags ClickFix scripts so you can find and remove the injected code.
EtherHiding
The payload is fetched from a blockchain contract, so it can’t simply be taken down. The infected file on your site is the only place to catch it.
How Moatline helpsThe scanner detects EtherHiding loaders in infected files and database content.
Reinfection
Backdoors and scheduled tasks in the database quietly reinstall the malware after you’ve cleaned up.
How Moatline helpsThe DB cron cleaner finds and removes hidden reinfection tasks in the database.
02 What’s inside
Free for everyone. No account, no licence key, no limits.
Checks plugins, mu-plugins, the active theme, drop-ins, wp-login.php, uploads and the database for known malware and suspicious code. Findings name the matched malware family.
Every file in your WordPress.org plugins is compared with the official release. Untouched files are verified clean; modified ones are flagged.
One click stops plugin and theme installs and edits, and blocks PHP from running in the uploads folder.
Move the login page to a private address and send bots probing wp-login.php to a 404.
Removes known malicious scheduled tasks and option keys that reinstall malware after a cleanup.
Records security events with JSON export. A dashboard score and checklist show what to fix next.
Checks posts, pages, revisions, Elementor data and widgets for malicious scripts, DNS loaders and blockchain-hosted payloads.
Add authenticator-based two-factor login with backup codes. Password logins over XML-RPC cannot bypass the second step.
Choose allow, Jetpack-safe or block mode. Blocking options stay off until you enable them.
Limit login attempts, review sessions and application passwords, and trace who saved malicious scripts into site content.
03 How it works
Four steps, all in the free plugin.
Step 1
Install Moatline from Plugins → Add New, then open Malware Scanner → Scanner. Scan files and database content; pause or resume when needed.
Step 2
Each result names the malware family. Plugin files that match the official WordPress.org release are verified clean.
Step 3
One click stops plugin and theme installs and edits, and blocks PHP from running in the uploads folder.
Step 4
The database cron cleaner removes the scheduled tasks and option keys that reinstall malware after a cleanup.
You stay in control. The free plugin never deletes or changes files on its own. Scans only report what they find, and nothing changes unless you click a button.
04 Free and Pro
The free plugin finds and reports infections and helps you secure your site. Moatline Pro is a separate, optional add-on. Explore current plans on moatline.io.
Find infections and protect access to your site. No account or licence key required.
File, database and content scanning
WordPress.org integrity check
Two-step login and XML-RPC protection
Login protection and lockdown
Database cleaner, activity log and security score
For site owners and agencies who want help removing threats. The free plugin works on its own.
One-click malware removal
Restore modified WordPress.org plugin files
AI verification of findings
Block malware call-home connections
Daily scheduled scans with email alerts
In your WordPress dashboard, go to Plugins → Add New and search for “Moatline Malware Scanner”. Install and activate, then open Malware Scanner → Scanner to run your first scan.
Read the installation guide05 Who builds it
Next Nova Technologies has built and repaired WordPress websites for 8 years. Moatline Malware Scanner comes out of that work.
Real infections
The scanner’s detections come from infections we have found and removed on real client sites, not from a generic signature list.
Fewer false alarms
Untouched plugin files are verified clean against the official release, so the results point at what was really changed.
Support
Your questions go to the people who built the plugin.
Site hacked right now? Our team cleans up hacked WordPress sites: see WordPress security, or email support@nextnova.tech and we’ll take a look.
See website repair06 Available now
The free plugin is live on WordPress.org. Download it today, or visit moatline.io for documentation, security guides and Pro plans.
07 Questions
Still unsure about something? Message us. A real person replies.
Ask on WhatsAppMoatline Malware Scanner is released and available free on WordPress.org. Search for “Moatline Malware Scanner” under Plugins → Add New in your dashboard, install and activate it, then run your first scan.
Yes. File and content scanning, integrity checks, two-step login, XML-RPC protection, lockdown, login security, the database cleaner and activity log are free. No account or licence key is required. Pro is optional.
No. The free plugin only reports what it finds. Nothing on your site changes unless you click a button.
Yes. Moatline does not run a firewall that clashes with other security plugins. Run one malware scan at a time if your hosting has limited resources.
ClickFix is a fake “verify you’re human” pop-up that tricks visitors into running malicious commands on their own computer. EtherHiding loads malicious code from a blockchain contract, so it can’t simply be taken down. Moatline Malware Scanner is designed to catch both.
Yes. Our team cleans up hacked WordPress sites (see WordPress security). Email support@nextnova.tech and we’ll take a look.
Please email support@nextnova.tech privately with the details. For general plugin help, use the WordPress.org support forum.
