The free plan is a real scanner,
not a countdown to a sales call.

Free runs signature matching against a bundled malware definition set, heuristic analysis for the constructs malware tends to need (eval on encoded input, base64 chains, execution hidden behind a request parameter) and file integrity checking, which hashes your WordPress core against the official WordPress.org checksums and your plugins and themes against their installed-version baseline.

That integrity layer is the one people underestimate. It does not need to recognise malware at all. It only needs to notice that a file is no longer what the people who wrote it shipped. A modified core file is a strong signal whether or not anybody has catalogued the payload inside it, which is precisely the case for the malware that matters most: the sample written last week for one campaign, that no signature set has seen.

The fourth layer is the database scanner, and it is the reason to take the free tier seriously. It reads wp_options, wp_posts, wp_postmeta and wp_comments directly, deserialises PHP-serialised values so a payload cannot hide inside a nested array, and flags hidden iframes, base64-encoded blobs, injected spam links, JavaScript redirects and eval()-style backdoor code. Every finding is rated by severity so you know what to open first.

Anything the database scanner flags can be cleaned from the dashboard in one click. You are not handed a table name and a row ID and left to write SQL against your own production database at eleven at night.

A full-site scan is the default, but it is rarely what you want at four in the afternoon on a live site. You can scan core only, plugins only, themes only, or uploads only. After updating a plugin, scanning plugins takes a fraction of the time and answers the only question you actually have.

Uploads-only deserves its own mention. The uploads directory is where a compromise most often lands first, because it is the one directory a site is designed to let strangers write to. A PHP file in uploads has no legitimate reason to exist, and a scan scoped to that directory finishes quickly enough to run often.

Scheduling runs daily or weekly, whichever suits the site's rhythm, and you get three on-demand scans a day on top, enough to verify a fix without waiting for the next cycle. Malware definitions ship with the plugin and update as it updates, so a free install does not slowly rot into a scanner that only recognises last year's threats.

Free does not include the LLM scanner, so code that has never been catalogued is assessed by heuristics rather than by reasoning about what it is written to accomplish. It does not include one-click hardening, brute-force lockout, two-factor authentication or reCAPTCHA: those are in the Premium add-on, starting at Basic. There is no real-time file monitor, so a change is caught on the next scheduled scan rather than as it happens. There is no audit log, so reconstructing an incident afterwards is harder. There are no email notifications, so you find out when you open the dashboard.

And there is no one-click malware removal. Free tells you what is wrong, in specific terms, with file paths and severity. You fix it.

That is a real limit and we would rather state it here than let you discover it during an incident. It is also, for a great many sites, entirely sufficient: knowing accurately and early that something is wrong is most of the value, and a site owner who checks a dashboard weekly is far better placed than one who finds out from a customer.