Every WordPress site now includes Antivirus. It helps you find harmful files and common security gaps, explains them in plain language, and lets you fix them with a click.

You can scan at any time, review what needs attention, and apply fixes safely.

What’s new

1) Shield: scan, review, and fix

Shield shows how many items need attention and when the site was last scanned.

• Scan now runs a fresh scan at any time
• Action required lists each issue and why it matters
• Use Apply fix, or Apply all fixes to resolve everything at once
• You can snooze an item until the next scan, for 7 days, or for 30 days
• Resolved keeps the last 30 days of fixes

2) Checks included in each scan

Antivirus runs ten checks and shows a clear result for each one (Passed or Action required). These checks include:

• Core and plugin files compared against their official versions
• Unused plugins and protections that are turned off
• HTTPS status, WordPress version, and supported server software
• Hidden error messages and search engine visibility settings

3) Safer fixes with backups

Before applying a fix, you’ll be asked to confirm. You can also see when the last backup was taken and choose to back up first.

4) Hardening

Antivirus includes ten one-click protections. Each one includes a short explanation, and you can turn them all on together if you prefer.

• Block application passwords and user enumeration
• Hide the WordPress version and mask login errors
• Disable the file editor and XML-RPC
• Add security headers and rate-limit login attempts
• Harden .htaccess

5) Threat visibility across all sites

• A Threats column is available on the WordPress sites list
• Hover the count to see what was found, then select Check threats
• Scan all sites in one click

How to use this feature

1. Go to Sites → WordPress
2. Open a site
3. Open Antivirus → Shield
4. Review Action required, then click Apply fix or Apply all fixes
5. Open Antivirus → Hardening and enable the protections you want

Why it matters

• Find and fix site issues before visitors notice them
• Reduce the risk of break-ins with straightforward protections
• Apply fixes with more confidence by taking a backup first
• Manage security for every client site from one place

Notes

• Applying a fix changes the live site. Take a backup first if you may need to roll back.
• Leave Disable XML-RPC off if you use the WordPress phone app.
• Antivirus helps close common security gaps, but it does not replace updates and regular backups.