How to Check if a WordPress Plugin Contains Malware Before Installing It

Installing a plugin in WordPress gives it access to a very sensitive part of your site. A plugin can read data, create tables, modify settings, load scripts, communicate with external servers, and execute PHP code.

That's why, before installing a plugin from any source—especially if it doesn't come directly from the original developer or the official WordPress repository—it's a good idea to perform a basic security check.

This guide won't turn anyone into a forensic analyst, but it does help reduce common risks.

1. Check the file's source

The first question is not a technical one: Where did this ZIP file come from?

A plugin downloaded from WordPress.org, the author's official website, or a reputable provider with identifiable support does not pose the same risk as a ZIP file shared on a forum, Telegram group, or via an anonymous link.

Before installing, check the following:

• Supplier Name.
• Product page.
• Date updated.
• Plugin version.
• Support and Reporting Policy.
• Clear information about the license.
• A real-time communication channel.

If the file cannot be traced, do not use it in production.

2. Compare the version

Check the author's website to see what the current version of the plugin is. Then compare it to the version you downloaded.

If the vendor claims to have a very new version but there is no changelog, or if the version number does not match any public reference, you should investigate.

Also keep an eye out for "premium" plugins that appear with unusual names or in folders other than the original product's folder. It's not always malware, but it is a sign that you should take a closer look.

3. Inspect the ZIP file's structure

A WordPress plugin usually has a relatively clear structure:

• Main plugin folder.
• Main PHP file with a plugin header.
• Folders such as includes, assets, admin, public, languages, templates.
• Files readme.txt, license.txt or documentation.

Warning signs:

• PHP files with random names.
• Hidden folders.
• Unnecessary executable files.
• PHP within image folders.
• Files with duplicate extensions, such as image.php.jpg.
• Code added outside the normal structure.
• Many files have been modified on the same date for no apparent reason.

Not every suspicious file is malware, but every suspicious file deserves to be checked.

4. Look for obfuscated code

Obfuscated code is designed to hide what it does. It sometimes has legitimate uses, but in WordPress plugins it's a red flag, especially if it appears in unexpected places.

Look for patterns such as:

• eval(
• base64_decode(
• gzinflate(
• str_rot13(
• shell_exec(
• exec(
• passthru(
• system(
• assert(
• preg_replace with a modifier e in legacy code
• Variables with very long random names
• Large blocks of illegible text

The presence of a function alone does not prove that malware is present. Some legitimate plugins use advanced functions. But if you find combinations such as eval(base64_decode(...)), stop.

5. Scan the file before uploading it

You can use tools such as:

• Local antivirus.
• VirusTotal for small files.
• Wordfence in a test environment.
• Sucuri SiteCheck to check the site later.
• Hosting scanners, if your provider includes them.

Keep in mind that no scanner can detect everything. A clean result reduces risk, but does not guarantee absolute security.

6. Install on the staging environment first

Never test a questionable plugin directly in production.

A staging environment allows you to observe:

• If the plugin creates users.
• If it modifies unexpected files.
• If it generates PHP errors.
• If you make external calls.
• If you change critical settings.
• It does affect performance.
• If it breaks the checkout, login, or forms.

After installation, check the server logs, WordPress errors, and user activity.

7. Check permissions and behavior

After activating the plugin, take a look:

• New administrator users.
• New cron jobs.
• Changes to .htaccess.
• Files added on wp-content/uploads.
• New options in wp_options.
• Unexpected external connections.
• Strange redirects.
• Code inserted into posts or widgets.

Many attacks do not show immediate symptoms. Some take days or weeks to become active.

8. Keep backups before and after

Before installing any major plugin:

• Database backup.
• File backup.
• Hosting restore point.
• Record of the installed version.

If something goes wrong, a quick restore can save hours of cleanup.

9. Don't install more than you need to

Every plugin adds to the attack surface. Even legitimate plugins can have vulnerabilities, as is regularly seen in security reports from the WordPress ecosystem.

Best practices:

• Remove inactive plugins.
• Update frequently.
• Use plugins that are actively maintained.
• Avoid duplicating functions.
• Don't keep plugins "just in case.".
• Check for known vulnerabilities before installing.

10. Document the source for your customers

If you're a freelancer or an agency, please provide the following:

• Where did the plugin come from?.
• Which version did you install?.
• Whether or not it includes an official license.
• The customer will receive support from the author.
• How future updates will be handled.
• What risks and limitations are there?.

This protects the client and also protects your work.

Quick Checklist

Before installation:

• I know the origin of the ZIP file.
• This version matches the actual version.
• The supplier has a good reputation and is easy to contact.
• I reviewed the file structure.
• I looked for suspicious obfuscated code.
• I scanned the file.
• I tested it on the staging environment.
• I made a backup.
• I verified that it does not create any unusual users or files.
• I documented its origin and limitations.

Conclusion

WordPress security does not depend solely on whether a plugin is free, premium, or GPL. It depends on its source, integrity, maintenance, updates, and technical criteria.

An inexpensive plugin can end up costing a lot if it compromises a website. And an expensive plugin can also be insecure if it's abandoned or configured incorrectly.

The most practical rule: Do not install files that you cannot track, review, or restore..

Si quieres conocer otros artículos parecidos a Cómo revisar si un plugin de WordPress tiene malware antes de instalarlo puedes visitar la categoría Ayuda y Soporte.