Malware Scanning SOP

Malware Scanning SOP
Server-side scanner (maldet, ClamAV) vs plugin scanner (Wordfence) vs external integrity check. Layer them.

— Use a server scanner when: you control the box and want filesystem-wide detection independent of any compromised app.
— Use a plugin scanner when: you only have app access (managed host) and want WordPress-aware signatures and core-file diffing.
— Use external integrity monitoring when: you need detection a rooted box can't suppress. A compromised scanner reports clean.
— Prefer core-file comparison over signature-only: it catches modified wp-includes that no signature knows yet.
— Verify: plant a benign EICAR test file, confirm each layer flags it.

Run this when you suspect compromise or onboard a site.