One scanner. Nine stages. Nothing hidden.
SecureCrawl does one thing: WordPress security, from inside the server. Here is exactly what runs when you press Scan.
Connect
You add the site and paste our public key into your hosting panel (cPanel: SSH Access → Import Key → Authorize). The key only opens this account, is read-only in practice, and can be removed any time. Nothing is installed in WordPress.
Locate
The scanner finds every WordPress install under the account, reads wp-config.php for the database settings, and checks the WordPress version against the current release.
Verify core
Every file in wp-admin, wp-includes and the root is hashed and compared with the official checksums for that exact version. Changed files and files that should not exist are flagged.
Verify plugins
Each plugin is matched to wordpress.org: version, last update, whether it was closed. Plugin files are compared with the official build, so an edited plugin file stands out even when the code looks normal.
Hunt
Every PHP file is scanned for the patterns attackers use: eval of decoded data, code that runs visitor input, hidden uploaders, self-hiding plugins, remote code loaders. Clean official files are excluded first, so the noise is low.
Server rules
.htaccess and PHP settings are checked for redirects aimed at search visitors, files forced to run before every page, and handlers that execute images as code.
Database
Administrator accounts (new or odd-looking), scripts stored in settings, hidden links and injected scripts in posts, adult and gambling spam, future-dated posts, and tables left by plugins removed years ago.
Report
Findings are ranked critical to low and explained in plain English. The summary is free. The Developer Report adds exact locations, decoded evidence and fix steps.
Auto-Clean
You tick the fixes to apply. Files are moved to a quarantine folder on your own server (never deleted); changed core and plugin files are replaced with clean copies from wordpress.org; every change can be undone. Then the site is re-scanned.
Safety rules the scanner never breaks
Scans change nothing
Only Auto-Clean writes to your server, only after you approve each change.
Nothing is deleted
Removed files go to a quarantine folder on your own server and can be restored with one click.
Only sites you control
Deep scans need a key you install, so they only ever run where you have access.
Scan copies are temporary
Copies made during a scan exist only to produce your results and are deleted when the job closes.
See the nine stages run on your own site.
Free deep scan, no card.