Search the files and database of your WordPress install for signs that may indicate that it has fallen victim to malicious hackers.
As of April 2026, Exploit Scanner is a WordPress hack plugin with 9.0K+ active installations and a 3.2/5 rating from 40 reviews. It has been downloaded 1.1M+ times in total. Requires WordPress 3.3+ and PHP false+. Available on WordPress.org since 2008. Last updated 8 years ago — may have compatibility concerns. Downloads are down 15% this week. Top alternative: WP Limit Login Attempts.
This plugin searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames.
It does not remove anything. That is left to the user to do.
Latest MD5 hash values for Exploit Scanner:
Latest SHA1 hash values for Exploit Scanner:
Apparently abandoned or confuse.
Doesn´t work at all… it always shows an error, try later.
Just gives an error:
{“status”:”error”,”message”:”$this->files was not an array”,”data”:{“start”:250,”files”:”b:0;”}}
Others have posted in the support section and not had responses and the plugin has not been updated for a long time, so it looks to be an abandoned project.
Exploit Scanner is a useless plugin.
I mean, it does nothing.
It just lists hundreds of files of your server.
Says nothing about them.
And does nothing either.
In the end, it says you are a PARANOID.
If you have any further worries.
I think I will create a WordPress plugin too.
Great plugin, but it’s not well documented.
Anyways, it works on version 4.8.3 and theoretically any version as long as you generate (if you don’t have) the hashes for your wordpress version; in my case I had to generate for 4.8.3 and it did a good job 🙂
| WordPress | 3.3+ requiredTested up to 4.7.33 |
| PHP | false+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.