by Niraj Pal
0 (0 reviews)
Malroot Security
Catches database-resident backdoors, rogue admins, malicious MySQL triggers and self-healing rootkits other scanners miss.
Compatible with WP 7.0.2
v1.0.8
Current Version v1.0.8
Updated 2 weeks ago
Last Update on 10 Jul, 2026
Refreshed 10 hours ago
Last Refreshed on
Rank
#38,479
+8003 this week
Active Installs
10+
-2%
KW Avg Position
102.8
+0.3 better
Downloads
219
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
13,748
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 7 more installs to reach 20+
Rank Changes
Current
#38,479
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 4 of 4| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| backdoor | 9 | — | Tag | 22 hours ago |
| malware | 86 | — | Tag | 22 hours ago |
| scanner | 152 | — | Tag | 22 hours ago |
| firewall | 164 | — | Tag | 22 hours ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.8
- Last Updated
- Jul 10, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.0.2
- PHP Version
- 7.4 or higher
- Author
- Niraj Pal
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,724
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#988
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#7
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Frequently Asked Questions
Common questions about Malroot Security
No — Malroot is designed to complement file-based scanners, not replace them. It catches the database-resident, REST-based, and trigger-based threats that file scanners typically miss. Run both for layered protection.
Files are moved to a private folder under wp-content/uploads/malroot-quarantine/ (protected by .htaccess). Database options, postmeta, users, and triggers are backed up to a quarantine table and then removed. Every action is reversible from the Quarantine page.
No. Malroot verifies changed files against official WordPress.org checksums. Files that match are auto-accepted silently — you only see findings when something genuinely doesn't match.
Standard TOTP (RFC 6238). Each user enables 2FA from their profile, scans a QR code with Google Authenticator, Authy, 1Password, or any compatible app, and confirms with a 6-digit code. Eight one-time recovery codes are generated during setup. Site administrators can require 2FA for all admin accounts in Settings.
By default, Malroot only contacts the official WordPress.org checksum APIs to verify your core and plugin files. Everything else is opt-in: IP geolocation is OFF until you enable it, and Slack alerts only fire if you configure a webhook. No site content, credentials, or scan results are sent to any third party. See the "External services" section below for full details.
Malroot does not generate a scannable QR code, because doing so would mean sending your secret key to an outside image service. Instead it shows the setup key as text, which you type into your authenticator app using its "Enter a setup key" option. Nothing about your 2FA secret ever leaves your server.
Single-site only in v1.0. Multisite support is on the roadmap.