Day by day, the world is becoming a dangerous place for you if you happen to be a blogger. And if you are a WordPress Blogger then the danger is just about double as compared to bloggers who use different blogging platforms. With new exploits being discovered everyday and with hackers and spammers using new methods of attacks to exploit these vulnerabilities, it is becoming increasingly difficult to make sure that the security of your WordPress blog is not compromised. But, this is not the end of the world and there is still hope as long as plugins like “WordPress Exploit Scanner“ are in existence and being updated regularly to counter the malicious intentions of the hackers and spammers. If you have got a WordPress blog and are smelling something unusual then do your blog a favor and scan your blog with the WordPress Exploit Scanner immediately.

“WordPress Exploit Scanner” is a plugin that searches the files on your website, the posts and comments tables of your database for just about anything suspicious. It also examines your list of active plugins for unusual file names. But once done with the scanning, it stops at reporting the issues and does not remove anything on it’s own. Thankfully, that party is left to the user to do. So it will obviously not stop someone from hacking into your WordPress blog, but it may help you find any uploaded or compromised files left by the hacker.

Installation:
- Download WordPress Exploit Scanner and unzip the plugin.
- Copy the exploit-scanner directory into your plugins folder.
- Visit your Plugins page and activate the plugin.
- A new menu item called “Exploit Scanner” will be made off the Dashboard.

When a website is compromised, hackers usually leave behind scripts and modified content that can be found by manually searching through all the files on a site. Some of the methods used to hide their code or spam links are obvious, like using CSS to hide text, and we can search for those strings.

The database can also be used by the hackers to hide content or be used to run code. Spam links are sometimes added to blog posts and comments. They’re hidden by CSS so visitors don’t see them, but search engines do. Recently, hackers took advantage of the WP plugin system to run their own malicious code. They uploaded files with the extensions of image files and added them to the list of active plugins. So, despite the fact that the file didn’t have a .php file extension, the code in them was still able to run! Thankfully, “WordPress Exploit Scanner” plugin searches through your blog and attempts to find those changed files and db records.

Warning! Searching through the files on your site will take some time. Even a clean WordPress install with no plugins will probably take a noticeable length of time. It’s also heavy on your server. Only run the file check when your server is idling and not busy.