Security scan
- Known vulnerabilities1
- Suspicious code2
- Changed files0
- Exposed files0
A free security scanner for your WordPress site.
The free Arva SEO plugin checks your site every week for signs of a hack, explains what each finding means, and offers repairs you can undo.
The security scan works without an account. Known-vulnerability alerts are free on every plan.
01The weekly scan
What the scan checks.
It runs on your own server, in small batches in the background, so visitors don’t notice it.
- WordPress’s own files, and plugins from WordPress.org, compared with their official copies
- Code where WordPress never puts it, such as PHP files in the uploads folder
- Patterns found in hacked websites, in every file that isn’t a verified official copy
- Private files anyone can download, such as .git, .env, debug.log and database backups
- Settings that make an attack easier, such as file editing in the dashboard or an administrator called admin
- Whether your server’s PHP has its latest security fixes
02Beyond the scan
More than a file check.
Known vulnerabilities
Every day, the versions of WordPress, plugins and themes you have are compared with Wordfence Intelligence’s vulnerability database, with the version that fixes each one.
Deep scans
Your theme, premium plugins and other files the scan can’t match to an official copy, checked on Arva SEO’s servers against ClamAV’s malware database and our own rules.
Repairs you can undo
Restore the official copy of a changed WordPress or plugin file, or move suspicious PHP into quarantine, where it can’t run. Each repair can be undone for 30 days.
It learns from other websites
Malware a deep scan finds on one connected site is recognised on every site’s next scan, and files our team confirms are safe stop being reported.
03How it treats your site
Careful, and honest about its limits.
- It never changes a file by itself: you choose each repair
- Results stay in WordPress unless an administrator chooses to share them
- Deep scans send code files only; never wp-config.php, .env files, logs, backups or media
- Critical and High findings alert you in Arva SEO and by email
- Every website audit also looks for signs of a hack on any platform: hidden spam links, the Japanese keyword hack and redirects from Google
- It isn’t a firewall and doesn’t remove malware, so keep updates and backups
04Plans
Free on every plan.
The weekly scan, repairs and known-vulnerability alerts are free. Deep scans are counted per website. Compare the plans.
- Free: the scan, repairs and vulnerability alerts
- Starter: plus 2 deep scans a month per website
- Professional: 8 deep scans a month per website
- Business: 16 deep scans a month per website
Is the WordPress security scanner free?
Yes. The weekly scan, the repairs and known-vulnerability alerts are free on every plan, and the scan works without an Arva SEO account. Deep scans on Arva SEO’s servers are included on paid plans.
Does it remove malware?
No. It finds known signs of trouble and explains what to do, and it can restore official copies of changed files or quarantine suspicious ones. It can’t prove a site is clean and isn’t a firewall, so keep WordPress, plugins and themes updated and keep backups.
Will the scan slow down my website?
No. It runs on your own server in small batches in the background, so visitors don’t notice it.
Can I use it with Wordfence?
Yes. It’s a scanner, not a firewall, so it works alongside firewall plugins such as Wordfence, All In One WP Security, MalCare or NinjaFirewall, whose own files it knows not to report.
What does Arva SEO receive from my site?
Nothing from the scan unless an administrator shares the results, and then only what each problem is, the file’s path and its fingerprint, never the file. Deep scans you allow send code files the scan couldn’t match, which are deleted as soon as the scan finishes.
06Related features
Works well with.
Speed Booster plugin
Free PageSpeed fixes you switch on one at a time, and publishing from Arva SEO.
Page caching
Pages saved as ready-made HTML, kept fresh, and checked before it switches on.
Image optimization
Images compressed on your server for free, or on ours, with the originals kept.
Site audit
About 60 checks on every page, an SEO Health score and a fix list.
07Start today
Your first website is free.
Install the free plugin, or create an account to get vulnerability alerts for every WordPress site you run.