Quttera ThreatSign lets you run on-demand scans and investigate results from the WordPress admin area. A ThreatSign Website Security plan adds ongoing protection and response, including expert cleanup, automatic malware removal, continuous and scheduled scans, a Web Application Firewall (WAF), DDoS protection and mitigation, blacklist removal across more than 40 security authorities, and 24/7 monitoring.

Read scan results and select a response

Cloud-based scanning uses an AI-driven heuristic engine while reducing server resource load. It analyzes rules, weighted systems, emulators, flow patterns, and statistical methods to find potentially malicious functionality, including threats that may not match traditional signatures.

• Malicious PHP, including backdoors, shells, and injections
• Obfuscated or polymorphic JavaScript
• Malicious iframes, redirects, hidden links, spam, and SEO malware
• Checkout skimmers on checkout pages
• WordPress core integrity issues and unauthorized documents in core directories
• External links and outbound references
• Blacklist checks against more than 40 security authorities
• Investigation reports with severity levels

A severity level signals potential risk and helps prioritize review; it does not by itself establish whether a finding is harmful. Use the investigation details to assess suspicious files. A paid plan adds automated removal and expert cleanup when a response is needed, alongside continuous and scheduled scanning.

Control login attempts and bot traffic

Brute-force controls can lock out attempts by IP, apply configurable thresholds and progressive delays, and use soft or hard locks. IP allow and deny lists support CIDR notation, while combo-lock detection checks IP and username together. Email alerts can report locked accounts. Policies account for hosting environments: shared hosting can use aggressive locking, while dedicated servers can use progressive delays. An emergency bypass is available for critical situations.

Bot protection evaluates risk across requests, applies token-bucket rate limits, and recognizes legitimate bots such as Googlebot and Bingbot. Controls can cover the REST API, XML-RPC, and WooCommerce checkout and cart endpoints. Choose Observe, Balanced, or Aggressive mode; risk-based challenges and exponential backoff are also supported.

Track administrator changes

Monitoring detects additions and removals of administrator accounts and changes to administrator roles, with alerts and a database audit trail. Snapshots let you compare account states. Checks execute on a schedule and during WordPress admin activity, with WordPress hooks enabling immediate detection of user and role changes.

Get started

Open Quttera ThreatSign in the WordPress admin area and run an on-demand scan to review the website. Upgrade to a ThreatSign Website Security plan for the broader service set, then configure protection and review investigation reports, severity levels, and account alerts in the WordPress security process.