Quttera ThreatSign – Web Malware Scanner for WordPress

The scanner identifies a wide range of threats, including:

• Obfuscated JavaScript
• Injected or malicious PHP code
• Hidden iframes, redirects, and links
• Spam and SEO malware
• Card skimmers targeting WooCommerce checkout pages
• Suspicious external links
• Backdoors and PHP shells
• Infected or modified WordPress core files

Heuristic and AI-powered analysis enables detection of new or unknown malware, not just known signatures.

The free version includes:

Malware Detection:
* On-demand scans from the WordPress admin
* Blacklist checks across 40+ services
* Malware detection (JS, PHP, backdoors, spam, iframes, skimmers, etc.)
* Investigation report with severity levels (Clean, Potentially Suspicious, Suspicious, Malicious)

Brute Force Protection:
* IP-based locking and failure detection
* User account lockout protection
* IP whitelist and blacklist management
* Email alerts for locked accounts

Bot Protection:
* Rate limiting and risk-based evaluation
* Legitimate bot recognition
* REST API and WooCommerce endpoint protection
* Configurable protection modes

Admin User Monitoring:
* Real-time detection of admin user changes
* Email alerts for additions, removals, and role changes
* Database audit trail with snapshots

To enhance protection with automated responses, scheduled scanning, and advanced WAF features, upgrade to ThreatSign Website Security.

Traditional scanning uses signature matching. Heuristic scanning uses rules, weight-based systems, emulators, flow analyzers, and statistical methods to detect potentially malicious functionality, even in previously unknown threats.

Quttera’s severity levels indicate potential risk. If you’re unsure whether a detection is harmful, our team can help. Contact us via ticket at https://helpdesk.quttera.com, email [email protected], or the plugin’s WordPress Support Forum.

Yes. Our ThreatSign Website Security plans provide:

• Expert malware cleanup
• Automatic malware removal
• Continuous & scheduled scans
• Web Application Firewall (WAF)
• DDoS protection & mitigation
• Blacklist removal (40+ authorities)
• 24/7 monitoring & protection

Learn more: https://quttera.com

This usually happens if your hosting assigns only one PHP worker. The scan process occupies the only worker, temporarily blocking the site until the scan completes.

Ensure JavaScript is enabled and your firewall isn’t blocking plugin requests. The plugin communicates with the backend via JavaScript-generated HTTP requests.

Use the “Download Report” button, save the file, and send it to us via https://helpdesk.quttera.com/open.php.

Your hosting may not allow WordPress Cron to function properly.
You can enable an alternative cron method by adding this line to wp-config.php:

define(‘ALTERNATE_WP_CRON’, true);

Submit them via: https://helpdesk.quttera.com/open.php

For questions about investigation process please refer to http://quttera.com or post in the Support section here.

Brute Force Protection defends against unauthorized login attempts by tracking failed logins per IP address and username combination. It applies progressive locking:
* Soft lock: Introduces account lockout after configurable failures
* Hard lock: Completely blocks the IP after repeated failures
* Emergency bypass: Can be enabled via constant QTR_BRUTEFORCE_BYPASS or filter hook for critical situations

The protection is environment-aware, with different strategies for shared hosting (aggressive locking) versus dedicated servers (progressive delays).

Bot Protection uses multi-stage risk evaluation to detect and rate-limit automated attacks. It examines:
* User-Agent signatures and heuristics
* Request rates and patterns across different endpoints
* Risk scores for specific endpoints (REST API, XML-RPC, WooCommerce, etc.)

Legitimate bots (Googlebot, Bingbot) are recognized and granted elevated rate limits. The system operates in three modes:
* Observe: Logs threats without blocking
* Balanced: Soft enforcement with fail-open for checkout (default)
* Aggressive: Hard enforcement on all endpoints

If you’re locked out by Brute Force Protection, you have two options:
1. Add to wp-config.php: define('QTR_BRUTEFORCE_BYPASS', true);
2. Or use the filter hook: apply_filters('qtr_bruteforce_emergency_bypass', false) returning true

After enabling bypass and regaining access, disable it and configure a proper IP whitelist.

Admin User Monitoring detects and alerts on:
* New admin users being added to the site
* Admin users being removed
* Administrator role being assigned or changed

The plugin creates database snapshots to compare with previous states, providing a comprehensive audit trail. Checks run automatically every minute via WP-Cron and also on every WordPress admin page load.

Yes. The plugin automatically detects your hosting environment and applies appropriate policies:
* Shared Hosting: Minimal delays (avoid blocking precious worker processes), aggressive locking
* Dedicated Server: Progressive delays, higher failure thresholds, more forgiving approach

You can also manually configure IP whitelists/blacklists regardless of hosting type.

Admin user monitoring checks run:
* Every 1 minute (via scheduled WP-Cron)
* On every WordPress admin page load (via admin_init hook)
* Immediately when users are added, removed, or roles are changed (via WordPress hooks)

This multi-layered approach ensures rapid detection of unauthorized changes.