Scan WordPress databases for malware with Imunify360 (root guide)

Not all malware lives in files. Many WordPress infections inject JavaScript redirects or spam links into posts, options or widgets in the database. File scans miss these. The Imunify360 Malware Database Scanner (MDS) checks WordPress databases and can clean them.

On MdmHost hosting plans this is handled by our team. This guide is for administrators of their own cPanel server with root SSH access.

Before you start

• Imunify360 installed with database scanning available in your licence (see installing Imunify360).
• A fresh database backup, for example a JetBackup database restore point or an export from phpMyAdmin.

Signs of a database infection

• Visitors are redirected to spam or scam sites, often only on mobile or only for first visits.
• File scans come back clean, but the problem continues.
• Strange <script> tags appear in post content or in wp_options values such as siteurl, home or widget settings.

Scan from WHM

1. Go to WHM → Plugins → Imunify360 → Malware Scanner.
2. Open the Users tab, select the account and choose a database scan (shown as Scan databases or similar, depending on version).
3. Results appear with the database, table, and the rows or fields affected.

On many versions database scanning is also part of the regular user scan when enabled in Settings → Malware.

Scan from SSH

The scanner can be run against a WordPress install path:

imunify360-agent malware user scan --user username

Check imunify360-agent malware user scan --help for the database options on your version; newer versions scan databases of detected WordPress installs automatically. See Imunify360 CLI commands.

Clean the database

1. Review the findings. Confirm the flagged content is malicious and not, for example, a legitimate tracking script.
2. Choose Clean. MDS removes the injected code and keeps a backup of the original values.
3. Test the site in a private window, including mobile.
4. Purge LiteSpeed Cache and any CDN, or visitors keep receiving cached infected pages (see purging LiteSpeed Cache).

After cleaning

• Remove unknown WordPress administrator accounts.
• Change database user and WordPress passwords and regenerate salts in wp-config.php.
• Find the entry point, usually an outdated plugin, and update or remove it.
• Run a file scan as well (see file scanning).

The full site recovery checklist is in cleaning a hacked WordPress site.

Frequently asked questions

Does MDS work for non-WordPress sites?

It is designed for WordPress databases. For other apps, search the database for script tags and suspicious URLs manually.

Will cleaning remove my own scripts?

Only code matching malware signatures is removed. Review findings first; legitimate analytics snippets are not normally flagged.

How long does a scan take?

Usually minutes per database. Large WooCommerce databases take longer; run scans at quiet times.

Should I put the site in maintenance mode while cleaning?

For heavily infected shops, yes. It stops visitors being redirected while you clean and test.