PromoPilot Shield · website security

Website security monitoring and a WordPress malware scanner

Start with a free external scan right here. Shield goes further: a deep scan once you verify ownership, a server agent that looks for backdoors and malicious code in files and the database, a CVSS score for every finding, an AI report with a fix plan, and monitoring with email and Telegram alerts.

Free scan, no sign-up
Monitoring from $12/mo
70+ finding types, CVSS and OWASP
WordPress, Joomla, OpenCart, custom PHP

Scan your website now

The same engine as Shield in passive mode: an A+ to F grade and a list of findings.

Scan → monitoring. Add the site to Shield: scan history, a $19 deep scan after you verify ownership, and monitoring from $12/mo with alerts.

Set up monitoring

What a Shield report looks like

A free scan of our own site, unedited.

Shield report for promopilot.link: grade A, 86 of 100, 7 findings with CVSS, CWE and OWASP — promopilot.link, free scan on 7 Sep 2026: grade A (86/100), 1 medium, 3 low and 3 informational findings. The free report shows 3 findings in full; the deep scan unlocks the rest.

What Shield checks and who it is for

For site owners, studios and SEO specialists: a hack hurts rankings, as Google flags infected sites and drops them from results.

HTTPS and headers

Certificate expiry, outdated TLS, HSTS, CSP, X-Frame-Options, cookie flags, server version leaks.

CMS and library vulnerabilities

WordPress, Joomla, OpenCart, plugin and JS library versions against known CVEs.

Exposed files and access

.git, .env, backups, phpinfo, admin panels and directory listings in the deep scan (150–600 paths).

Malicious code

Hidden iframes, miners, skimmers, cloaking for Googlebot; from the inside, web shells and backdoors via the agent.

Email and DNS

SPF, DMARC, CAA, MTA-STS, so nobody sends phishing in your domain’s name.

Ready-made fixes

A plain-language AI report, PDF and ready .htaccess, nginx and DNS records for configuration issues (paid scans).

From a free scan to monitoring

Free scan
The form above: an A+ to F grade, visible issues and infection signs in about a minute.
Add the site to Shield
Sign in with Google or email. Shield keeps your scan history and gives up to 3 free scans a day.
Verify ownership
A DNS record, a file or a meta tag unlocks the $19 deep scan or the $49 comprehensive audit with the agent.
Turn on monitoring
Scheduled rescans and alerts about new serious findings by email and Telegram.

Shield pricing

One-off scans are paid from your balance; monitoring renews from the balance monthly and can be cancelled any time.

Free

Passive homepage scan, A+ to F grade
No sign-up, 10 a day
3 findings in full, the rest hidden

Deep scan

$19 one-off

Ownership verification required
150 paths, injection, SSRF, CORS, cloaking
All findings with CVSS, AI report, PDF, fixes

Comprehensive audit

$49 one-off

Everything in deep + 600 paths
Server agent: files and database
Subdomains and subdomain takeover

Monitoring Start

$12 /mo

1 site
Rescans every 30 days
Agent and alerts

Monitoring Pro

$39 /mo

5 sites
Rescans every 7 days
Agent and alerts

Monitoring Business

$99 /mo

20 sites
Rescans daily
Agent and alerts

In monitoring, verified sites are rescanned with a deep scan and unverified ones with a passive scan. Help with fixing and clean-up is quoted separately via Telegram.

WordPress malware and vulnerability scanner

Nothing to install in your WordPress admin. The deeper the level, the more we see, and the more access it needs.

Free

From the outside

WordPress version, plugins and themes visible in the code, matched against known vulnerabilities
Hidden iframes, obfuscated JS, miners and skimmers on the homepage
Blocklists: URLhaus, Spamhaus DBL

Deep scan · $19

WordPress hardening

User logins exposed via the REST API and default admin usernames
Enabled xmlrpc.php, public debug.log, readme.html
wp-config.php backups, uploads and plugins directory listing

Comprehensive · $49

From the inside: server agent

Core files vs official WordPress.org checksums
Web shells, backdoors, PHP in uploads, .htaccess rules
Code in database options, wp-cron jobs, new admin users
Abandoned plugins and plugins removed from the directory

The agent is a read-only PHP file: you upload it to the site root, it reads files and the database (using the credentials in wp-config.php) and sends a report. You can delete it afterwards. It comes with the comprehensive audit and every monitoring plan. It also works on Joomla, OpenCart and custom PHP sites, just without the core-integrity check.

Shield vs Sucuri SiteCheck, Wordfence and Mozilla Observatory

These are different kinds of tools, and they often work best together: for example, a firewall on the site plus external monitoring.

	PromoPilot Shield	Sucuri SiteCheck	Wordfence	Mozilla Observatory
What it is	External scanner + server agent + monitoring	Free external scanner (the Sucuri platform is separate)	Security plugin for WordPress	Free HTTP security header analysis
Platforms	Any site; the agent needs PHP hosting	Any site	WordPress only	Any site
Sees server files	Yes, with the agent (comprehensive, monitoring)	No, outside only	Yes, from inside WordPress	No
Firewall (WAF)	No	In the paid Sucuri platform	Yes, in the plugin	No
Malware clean-up	Not automatic; specialist help on quote	Paid Sucuri service	Paid Wordfence service	No

Based on the vendors’ public information as of October 2026; we do not list prices, so check their sites. Mozilla Observatory now runs as HTTP Observatory on MDN.

What Shield does not do

It does not block attacks in real time; it is not a firewall
It does not remove malware automatically
The free scan sees only the homepage, only from outside
Active checks only after ownership verification

When we are the better fit

You want checks without installing plugins
Your sites run on different CMSs, not only WordPress
You need a clear CVSS report for a client
You want to monitor several sites with Telegram alerts

Why website security monitoring matters

A one-off scan shows the site as it is today. But plugin vulnerabilities are published every week, certificates expire, and infections often stay hidden: malware hides from the admin and shows only to visitors from search. Monitoring rescans the site regularly and tells you about a new serious finding before Google or your customers notice it.

What CVSS is and why priority matters

CVSS is the standard 0–10 severity scale for vulnerabilities. Every Shield finding gets a CVSS score, a CWE code and an OWASP Top 10 category, so it is clear what to fix first: an exposed .env with passwords is critical, a missing header is low risk. The A+ to F grade reflects the number and severity of findings.

One account, the whole SEO loop

Shared balance and single sign-on: a project moves from one service to the next with the domain already filled in.

FAQ

Is Shield an antivirus?

No. Shield is a scanner and monitor: it finds vulnerabilities, signs of infection and misconfigurations and tells you how to fix them. It does not block attacks in real time (that is a firewall, WAF) and does not remove malware by itself; cleaning needs access to the site, and our specialists can help with a separate quote.

What does the free scan include?

A passive external check of the homepage: malicious code signs in the HTML, blocklists, HTTPS and TLS, security headers, cookies, visible CMS, plugin and library versions against a CVE database, SPF/DMARC/CAA. No sign-up, up to 10 fresh scans a day. We never run active probes (file discovery, injection tests) on sites without proof of ownership.

How does Shield scan WordPress for malware?

From the outside, through page code, blocklists and plugin and theme versions. From the inside, with the server agent: a read-only PHP file you upload to your hosting. It compares core files with the official WordPress.org checksums and looks for web shells and backdoors, PHP files in uploads, suspicious .htaccess rules, code injected into database options, malicious wp-cron jobs and recently created admin users.

Why do I need to verify ownership?

A deep scan sends hundreds of requests to the site: it looks for exposed .git, .env and backups and tests the injection and SSRF surface. That is only acceptable with the owner’s permission, so you add a DNS record, a file or a meta tag, once per domain.

How does monitoring work?

A subscription rescans your sites on a schedule: verified ones with a deep scan, the rest with a passive one. When a new critical or high-severity finding appears, you get an email and a Telegram message. Plans: Start $12/mo, Pro $39/mo, Business $99/mo; the server agent is included in all of them.

Is scanning safe for my site?

Yes. The free scan is passive: a few normal requests to the homepage. The deep scan does not exploit anything and changes nothing; it checks whether the server responds to risky paths and parameters. The agent only reads files and the database and writes nothing.