My own research: a WordPress scanner at scale

The challenge

When a WordPress site is compromised with cloaking or command-and-control (C2) malware, the owner usually doesn’t notice until Google or antivirus tools flag it, weeks later. I wanted a systematic way to detect active campaigns at scale, before the damage grows.

What I did

I built wp-seguro: a concurrent Python pipeline that scanned 25,399 Chilean WordPress sites:

• Cloaking detection: comparing the response served to a regular browser with the one served to Googlebot
• C2 domain detection: analysis of suspicious outbound calls in the served HTML
• Campaign classification: patterns to group the sites affected by the same actor
• Email notification to the affected owners, with the technical details and how to fix the problem

Result

Two active malware campaigns detected and classified, with 18 compromised sites identified, direct notice to the affected companies and the technical details to fix it.

The same capability now runs as a WordPress security audit service at scale for agencies, hosting providers or clients with multiple sites: proactive detection before SEO degrades or Google flags the site as compromised. The detector keeps evolving: the version in development adds detection of sites that are already hacked, not only vulnerable ones.