RatSweepr Free
$0
- Scan-only, read-only, never changes files
- Same signatures as paid version
- Help-report option for confusing results
- Source-available on GitHub
Find what's really hiding in your WordPress site. Then clean it without breaking anything.
A malware scanner and cleanup assistant for WordPress on shared hosting. No root. No agent. No deletions, ever.
Why hacked sites come back
A site gets "cleaned". A week later the spam, the redirects or the mystery admin are back. Seen it more times than I can count.
The cleanup removed what was visible and missed the rest: a leftover backdoor, a modified core file, a poisoned row in the database, a nulled plugin, or the hole the attacker came in through. One of those is enough to start over.
Pasting files into an AI chat doesn't fix this either. Without the full picture (files, database, users, cron jobs, and how they got in) you're guessing.
What the scanner checks
- Core and plugin files against the official wordpress.org checksums. That catches new malware nobody has a signature for yet.
- 33 YARA rules, a known-malware hash list and heuristics for webshells, obfuscated droppers, fake plugins, injected scripts and nulled-plugin leftovers.
- October 2026 campaigns: UpdraftCentral key-compromise backdoor, Rank Math SEO PRO 3.0.123 supply-chain compromise, vulnerable/outdated plugin checks.
- Optional Wordfence Intelligence vulnerability feed with your own free API key (attribution: "Vulnerability data provided by Wordfence Intelligence").
- The database: injected scripts, hijacked site URLs, suspicious admins and cron entries.
- Scanning is read-only. Cleanup moves files to a quarantine you can restore from, with a SHA256 manifest. It never deletes, and it won't run until you confirm you have a backup.
The honest part: heuristics can flag clean code, a compromised server can lie to any scanner, and it can't see DNS- or hosting-level problems.
RatSweepr Free
Scan-only, read-only version. Available at https://github.com/alltrad3s/ratsweepr-free. Latest release: v2.9.18-free.
What it does
- Scan with all detection rules
- Update signatures
- Share redacted reports (for malware research)
- Help-report option (send report to hello@ratsweepr.com if results are confusing or site seems infected but scan is empty)
- wp-config review
What it does not do
- No quarantine or file changes
- No database changes
- No cleanup commands
Quick install
- Upload ratsweepr.sh to your WordPress root (the folder with wp-config.php)
- SSH into your hosting account
- chmod +x ratsweepr.sh
- ./ratsweepr.sh scan
License
Source-available, all rights reserved, © 2026 Jorge Díaz. You may run it on sites you own or manage (including client sites). You may share reports for research. You may not redistribute, fork, rebrand, resell, hand the script to clients, or bundle it into a hosting/security/managed-WordPress offering. NOT open source.
Pick your path
RatSweepr Cleanup Kit
Launching soon
- Full scanner: scan, quarantine/restore, clean-core, shuffle-salts, baseline/verify, wp-config review
- ratsweepr-cleanup AI skill (guided cleanup with Claude Code)
- One bash script. Runs on shared hosting over SSH. No root, never deletes.
- Sold via Polar.
Done-For-You Cleanup
Per site · Regular $69 or High Priority $99 (introductory, until Jan 1, 2027)
- We clean it with RatSweepr. You never touch a terminal.
- Starts from a contact form (describe what you see). Payment requested once requirements are clear.
- Queue position starts at payment. 30-day conditional re-clean guarantee.
- Paid via Wompi. Many sites welcome (bulk quoted separately).
Free WordPress security guide (PDF)
The basics most hacked sites skipped: lock down your accounts, keep core, plugins, themes and PHP updated, stay away from nulled plugins (and make sure your developer does too), a quick look at security headers, and how to harden WordPress.
What clients say
-
"Jorge cleaned the malware off our WordPress site, hardened its security, and explained what he'd done in plain terms. We're happy with the result."
Jorge Acevedo, ANCORA S.A. de C.V.
-
"Our site had malware. Jorge removed it and locked things down so it doesn't come back. Clear process, no drama."
Mario Villeda, Nunez & Asociados
-
"Jorge has been our go-to for WordPress questions, from cleaning up infected sites to keeping our clients' sites secure."
Luis Guadron, Guadron Quijano
Privacy and research data
RatSweepr runs on your server and sends me nothing about your site. A future version will let you opt in to share anonymized results so detection gets better. It's off unless you turn it on, it shows you exactly what gets sent, and domains and personal data are stripped first.
FAQ
Does RatSweepr delete files?
No. Scanning is read-only. Cleanup moves suspicious files into a quarantine with a SHA256 manifest, so you can restore anything. It won't run until you confirm you have a backup.
Do I need root access?
No. It's a single bash script you run over SSH from your hosting account. No root, nothing installed on the server. If your host gives you SSH, it should work.
Does it send my site data anywhere?
No. By default nothing leaves your server. A future opt-in option will share anonymized scan results, and only if you turn it on.
Will it catch everything?
No scanner does. RatSweepr checks files, the database, users and cron jobs, but a compromised server can hide things, and DNS- or hosting-level problems are out of its reach. The report tells you what it checked.
My site was cleaned and got hacked again. Why?
Usually something was left behind: a backdoor, a database entry, a nulled plugin, or the vulnerability they used to get in. Scan everything and fix the entry point, not just the symptoms.
Can you clean my site for me?
Yes. Done-for-you cleanup is a fixed price per site, with scope agreed before I start. Use the contact form.
Contact
RatSweepr is the malware part. Most website problems aren't malware, and I fix those too. If your site, hosting, domain or email is giving you grief, write me.
What I can help with
- WordPress support: broken updates, white screens, plugin conflicts, slow sites, migrations.
- Malware cleanup and hardening, done with RatSweepr.
- Hosting: choosing a host, moving to a new one, DNS, SSL certificates.
- Domains: transfers, DNS records, renewals that went sideways.
- Email setup and deliverability: SPF, DKIM, DMARC, and why your emails land in spam.
- IT consultancy for small businesses: what to use, what to stop paying for, how not to get hacked.
To get a useful answer faster, include
- Your site URL. I keep it private.
- What broke and since when. Error messages or screenshots help a lot.
- What you've already tried.
- Who hosts the site and whether you have a recent backup.
- Your deadline, if there is one.
General questions: hello@ratsweepr.com. Done-For-You cleanup: dfy@ratsweepr.com.