Malware Scanner by Antivirus.ai – Shieldlume Security

Shieldlume Security by Antivirus.ai is a free WordPress malware scanner and security plugin. Review eligible core, plugin, theme and upload files, selected database content and the evidence behind each finding. Part of Plugins.shop.

Try the Free & Pro interface demo | Owner guide | Compare Free and Pro

WordPress antivirus and malware scanning

• Check eligible PHP/JavaScript for suspicious code patterns.
• Inspect selected WordPress database content.
• Compare file integrity with eligible WordPress.org references.
• On-demand/daily scans with saved progress and coverage details.

Login security and request protection

• Two-factor authentication (2FA): authenticator codes, recovery codes or password plus passkey.
• Optional login attempt limits, administrator enrollment and browser approval.
• A WordPress request firewall with Off/Observe/Block, scoped exceptions and host recovery.
• Separate login-page/XML-RPC request controls and an optional XML-RPC pingback switch.

Security reports and email alerts

Review severity, confidence, evidence and local guidance. Export findings or a JSON scan report. Optional critical email alerts and scan-end digests use your WordPress mail provider. Free local tools need no account, paid key or AI.

Configure optional sources separately: vulnerability information, host-managed ClamAV or signed hash indicators. Methods and limits.

The separate Pro add-on

Pro adds schedules, investigations, reports and reviewed eligible file restoration with the same scanner. First online activation unlocks local tools; expiry/outages retain the unlock, explicit Disconnect removes it. Services/AI need separate consent/access. Free never downloads Pro code.

Related plugins by Plugins.shop

Separate optional tools:

• Logged.ai – activity log: investigate supported site changes.
• ClickClue – session replay: review eligible visitor journeys with privacy controls.

More from Plugins.shop.

External services and privacy

Activation starts no scan/provider request. Connections need separate permission/configuration; no usage/conversion telemetry. Privacy/operator | Terms | Data/retention/withdrawal. Details are bundled in docs/privacy-and-services.md and privacy.txt.

• Antivirus.ai welcome/newsletter: separate unchecked choices send displayed domain, WordPress/PHP versions and language, or editable email/edition, to https://antivirus.ai/newsletter-api/v1/plugin-welcome/ . Consented reports refresh at most weekly plus edition changes; no source/findings/customer records. Email needs confirmation. Stop sharing in Protection settings; unsubscribe email separately. Sharing privacy, email privacy.
• WordPress.org references: permitted jobs send component/version, core locale, server IP/timing for official data compared locally. Privacy.
• Wordfence Intelligence: permitted/configured feed requests use your API credential and server connection, without source uploads. Saving a token does not enable requests. Terms, privacy.
• Signed indicators: the configured publisher receives protocol/version metadata and server IP for permitted updates, not inventory/source/samples. Destination/policy appears before enabling; no publisher/corpus is included.
• Local ClamAV: eligible bytes go only to a protected host daemon; the host maintains its engine/definitions, FreshClam requests and logs. Guidance.
• Emerging Threats: permitted https://rules.emergingthreats.net/blockrules/compromised-ips.txt downloads normally run every 12 hours. The provider sees server IP/timing, not visitor IPs/content; matching is local. Licence, privacy.
• Pwned Passwords: supported permitted checks send five SHA-1 prefix characters and server IP/timing to https://api.pwnedpasswords.com , never the password/full hash/username/email. Matching is local. Service, privacy.
• Exposure checks: permitted HTTPS probes contact this site’s public WordPress address. Its host/CDN sees selected paths and server IP/timing; up to 512 bytes are compared transiently, not uploaded to antivirus.ai.
• Email notifications: selected alerts/tests send content and recipient through your WordPress mail provider. Handoff is not delivery; interrupted/uncertain sends need review.

Free does not contact Pro/AI services. Separately licensed/consented Pro AI explains minimized detector metadata, not source files, and cannot approve repairs or verify infection. Service privacy, terms, AI privacy.

Chosen connections share only documented data. Hiding previews does not stop sharing; withdrawal can remain pending when unreachable. Handle exports/provider records/backups separately. Self-service software, without managed cleanup or response-time guarantees. Support.

Source code and third-party notices

Readable source, fonts and logos are bundled; no remote promotional assets load. Authentication/QR sources, builds and MIT licences: vendor/auth/NOTICE.md. Space Grotesk OFL: assets/fonts/OFL.txt.