Name: Segurium – Free Malware Removal & Antivirus Scanner, Hacked Website Cleanup, Firewall, 2FA
Availability: InStock
Rating: 5 (2 reviews)
Author: Segurium

Website hacked? Free malware removal and antivirus scan for WordPress: clean infected files, restore them. Firewall, brute force, 2FA included.

Segurium – Free Malware Removal & Antivirus Scanner, Hacked Website Cleanup, Firewall, 2FA

Site hacked? Segurium removes the malware, for free.
Most security plugins scan the site, name the infected files, and then ask for money to clean them. Segurium does the cleanup. It finds the infected files, removes the malicious code, and puts the original file back, with a reversible encrypted backup. The free tier covers up to 3 cloud cleanups per rolling 30 days, which is enough for a typical incident. No ad walls, no background processes that chew through your shared-hosting CPU budget.
If you are reading this because Google flagged your site, your host suspended the account, or visitors get redirected to a spam page, that is the job this plugin was built for. Segurium finds the malicious code these attacks leave behind in your files: injected redirects, Japanese SEO spam, pharma spam, uploaded shells and backdoors.
<h4>How to clean a hacked WordPress site with Segurium</h4>
<ol>
<li>Install Segurium and accept the service disclosure.</li>
<li>Run a malware scan. Files on the server are hashed and checked against the cloud verdict database.</li>
<li>Clean the infected files, one at a time or all at once with Fix All.</li>
<li>Run an integrity scan, and restore any WordPress core, plugin or theme file the attack rewrote.</li>
<li>Switch on the firewall, brute-force protection and two-factor authentication so the site does not get hacked again.</li>
</ol>
A file of yours that an attacker injected code into gets repaired: the injection goes, your content stays. A file that is nothing but malware, such as an uploaded shell, is emptied instead. Either way the original lands in an encrypted local backup first, and one click puts it back.
<h4>A small plugin in front of a large engine</h4>
Segurium hashes your files on the server and checks each against a continuously-updated, machine-learning-curated cloud verdict database — so most files are classified by hash alone, the scan is fast, the plugin stays small, and fresh threats are recognised the moment the classifier picks them up. When a file&#8217;s hash is not yet known to the cloud, Segurium uploads that file&#8217;s bytes for deeper analysis so you don&#8217;t get stuck with an unresolved verdict. Data is only sent with your consent.
<h4>What you get on every install</h4>
Every feature below ships in the plugin and runs on every install — Free and Pro alike:
<ul>
<li>Malware removal and cleanup — A full filesystem scan finds the infected files; one click strips the malicious code out and keeps an encrypted, reversible backup, so a wrong call is never permanent. A unified &#8220;Threats&#8221; view collects every finding.</li>
<li>Bulk &#8220;Fix All&#8221; remediation — Queue every detected threat for cleanup in one click on both malware and integrity panels.</li>
<li>Auto-cleanup on detection — Switch it on and a file that real-time scanning flags is cleaned without waiting for an admin to open the dashboard. Off by default.</li>
<li>Real-time and upload scanning — New and modified files are checked automatically; infected uploads are blocked before they land on disk.</li>
<li>Integrity scan — Verify WordPress core, plugins and themes against upstream manifests, and restore a rewritten file to its official content. That is how you undo a hack that edited legitimate files. Tampered, delisted and abandoned components show up here too.</li>
<li>Cleanup with encrypted, reversible backups — Before anything is cleaned, the original file is encrypted (AES-256-GCM) and stored locally. Backups are retained for up to 30 days, subject to per-bucket count and size caps. &#8220;Show original&#8221; and &#8220;Restore&#8221; are one click away.</li>
<li>Scheduled scans — Off / daily / weekly with a locale-aware time picker. Each run chains an integrity check behind the malware pass on the same cadence.</li>
<li>Two-factor authentication — TOTP apps, email fallback, backup codes, trusted devices, per-role enforcement and grace period.</li>
<li>Brute-force protection — Multi-tier lockouts on wp-login.php and XML-RPC, honeypot field, manual IP unlock, optional hCaptcha on login.</li>
<li>Firewall — Allow / deny IP rules, CIDR ranges and country-level filters with a single source-of-truth IP list shared across login, admin and request gating.</li>
<li>Geo-blocking — Block login or admin traffic by country using a local binary database (auto-updated), with a confirm-or-revert safety net so you can&#8217;t lock yourself out.</li>
<li>Security headers — Security HTTP response headers, cookie hardening (SameSite/Secure/HttpOnly), and five one-click preset modes.</li>
<li>Information Shield — Toggles that hide WordPress version fingerprints, discovery endpoints, asset <code>?ver=</code> strings, and XML-RPC when you don&#8217;t use them.</li>
<li>Self-Check security grade — Checks roll up into an A+ to F grade, each with one-click Fix buttons and cross-referenced with third-party services.</li>
<li>Migration importer — Import your settings from Wordfence, All-In-One Security and Solid Security so you don&#8217;t lose your hardening when you switch. Sucuri Security is detected too, but its settings live in Sucuri&#8217;s cloud dashboard and cannot be read locally, so there is nothing to import.</li>
<li>Disaster recovery — Local encrypted backups can be extracted with a tiny PHP one-liner, even if Segurium is uninstalled.</li>
<li>Embedded support.</li>
</ul>
<h4>How the Pro service tier differs</h4>
Our cloud service performs the cleanups and counts each against a per-installation quota. The Free service tier covers up to 3 cleanups per rolling 30 days — enough for an occasional incident on a typical site. The Pro service tier raises that quota for sites that need higher volume (recurring infections, hosts under sustained attack, sites with high reliability requirements). The plugin code, the detection engines, and every feature listed above are identical on both tiers; the only difference is the quota ceiling enforced server-side.
<h4>Privacy by default</h4>
<ul>
<li>Scanning is opt-in. Until you accept the service disclosure on the plugin&#8217;s admin page, nothing contacts the cloud and the plugin stays idle.</li>
<li>Hash-first, body-on-miss. During a scan, files are checked by SHA-256 first. Only files whose hash is unknown to the cloud have their bytes uploaded for classification, so the volume of content actually leaving your server is small and bounded by what&#8217;s new on disk.</li>
<li>No telemetry on your visitors. We look at files and security incidents, not at the people who visit your site.</li>
<li>On-premise mode. Switch off cloud-assisted malware detection and scans send hashes, paths and metadata only.</li>
</ul>
<h3>External Services</h3>
Segurium connects to external services to keep your WordPress install protected. Each service is disclosed below with the data that is sent and when. Nothing is sent before you accept the service disclosure on the plugin&#8217;s admin page.
<h4>Cloud Threat Inspection</h4>
Cloud Threat Inspection, our own service at <code>cti.segurium.com</code>, provides malware verdicts, integrity manifests, geo-location data, trusted-proxy IP ranges, support intake, cleanup files, and a per-installation quota on how many files it will clean in a rolling 30-day window. The service is contacted when:
<ul>
<li>A malware, integrity, real-time or upload scan is running.</li>
<li>You act on a plugin page. Accepting the service disclosure sends four things at once: a one-time installation registration (a random commitment hash, your site name, your site URL, your WordPress version, and, if you enabled email alerts, the alert email address you entered), a one-line <code>plugin_activated</code> ping, a <code>consent</code> record, and a first platform snapshot of the kind described below. Requesting cleanup of an infected file sends only that file&#8217;s SHA-256; the cleaned bytes come back by hash. A support request, false-positive report or missed-malware report sends the data you typed plus the file bytes you attached. A settings change sends a snapshot of that settings group. Deactivating the plugin sends a one-line <code>plugin_deactivated</code> ping, skipped entirely if you never accepted the disclosure. Activating it sends nothing on its own.</li>
<li>A daily scheduled job runs. Four of them exist. The GeoIP database update and the trusted-proxies update only fetch data. The component-inventory ping sends your installed plugin/theme slugs and versions and your WordPress version, so we can spot tampered, delisted or abandoned components. The platform snapshot sends how your site is built: your WordPress version, locale, multisite and debug flags, whether WP-Cron is disabled and whether the site is served over HTTPS; your PHP version, SAPI, memory limit, maximum execution time and maximum input vars; your web server and its version; your database engine and version; your operating system family and architecture; the plugin version; and your active theme&#8217;s slug and version. It carries no file contents, no paths and nothing about your visitors.</li>
<li>A brute-force lockout, geo-block or other security event fires. That sends a small JSON payload with the event type, your site URL, your domain, your WordPress / PHP / plugin versions, and a SHA-256 hash of the username, never the username itself or the password.</li>
</ul>
Data sent during scans (malware, real-time and upload alike): SHA-256 hashes of files on your server, file paths relative to your WordPress installation, file sizes, file modification times, plugin and theme version strings, and your WordPress version. For files whose SHA-256 is not yet known to the cloud verdict database, we also upload the file&#8217;s bytes so the file can be classified.
Turning the upload off: the &#8220;Cloud-assisted malware detection&#8221; setting on the Settings tab controls it. Switch it off for On-premise mode and scans send hashes, paths and metadata only, so a file whose hash the cloud does not recognise stays unresolved. Two uploads survive that mode, because you pick the file yourself: a false-positive report and a support-ticket attachment.
Retention: we keep file samples uploaded for analysis for up to 365 days, then an automated nightly purge removes them. The full schedule is in the privacy policy linked below.
A random installation identifier (IID), issued at registration time, identifies each request. We do not send your posts, pages, or anything about your visitors, and we never send a passwords. The privacy policy linked below names the data controller and how to reach them.
<ul>
<li>Terms of Service: <a href="https://segurium.com/terms" rel="nofollow ugc">https://segurium.com/terms</a></li>
<li>Privacy Policy: <a href="https://segurium.com/privacy" rel="nofollow ugc">https://segurium.com/privacy</a></li>
</ul>
<h4>Freemius (api.freemius.com, checkout.freemius.com, wp.freemius.com)</h4>
Segurium uses the Freemius WordPress SDK (bundled in <code>freemius/</code>) for license activation, paid-plan checkout and account management on the Pro plan. The SDK ships in anonymous mode: on activation Segurium tells it to skip the connect prompt, so it sends no request to Freemius and collects no telemetry from your install. Freemius, Inc. operates the service.
Freemius servers hear from your site only when you click an upgrade or &#8220;Manage billing&#8221; button on the account page and complete the checkout on <code>checkout.freemius.com</code>, or when you activate, sync or deactivate a Pro license there. In that second case the SDK posts the licence key, your site URL, your WordPress / PHP versions and the plugin version to <code>api.freemius.com</code>. Never open the account page and never enter a licence, and your site never calls Freemius at all.
<ul>
<li>Freemius Terms of Service: <a href="https://freemius.com/terms/" rel="nofollow ugc">https://freemius.com/terms/</a></li>
<li>Freemius Privacy Policy: <a href="https://freemius.com/privacy/" rel="nofollow ugc">https://freemius.com/privacy/</a></li>
</ul>
<h4>hCaptcha (js.hcaptcha.com, hcaptcha.com) — OPTIONAL</h4>
If, and only if, you enable hCaptcha on the brute-force-protection settings page and provide your own hCaptcha site key and secret key, Segurium will:
<ul>
<li>Load the hCaptcha JavaScript from <code>https://js.hcaptcha.com/1/api.js</code> on the wp-login.php page so the challenge can render.</li>
<li>Send the hCaptcha token and the visitor&#8217;s IP address to <code>https://hcaptcha.com/siteverify</code> to verify the challenge on login attempts.</li>
</ul>
hCaptcha is off by default. Until you enable it, no hCaptcha scripts or requests are loaded. hCaptcha is provided by Intuition Machines, Inc.; their terms and privacy policy apply when you enable the feature.
<ul>
<li>hCaptcha Terms of Service: <a href="https://www.hcaptcha.com/terms" rel="nofollow ugc">https://www.hcaptcha.com/terms</a></li>
<li>hCaptcha Privacy Policy: <a href="https://www.hcaptcha.com/privacy" rel="nofollow ugc">https://www.hcaptcha.com/privacy</a></li>
</ul>
<h3>Source Code of Bundled Libraries</h3>
Every release is mirrored at https://github.com/Segurium/segurium-plugin.
Segurium ships the Freemius WordPress SDK in <code>freemius/</code> for licensing, checkout and support flows. A small number of files inside that SDK (<code>freemius/assets/js/jquery.form.js</code> and <code>freemius/assets/js/postmessage.js</code>) are minified upstream and shipped as-is. The unminified source for the entire SDK is published under GPL-3.0 at:
<ul>
<li>https://github.com/Freemius/wordpress-sdk</li>
</ul>
The SDK version bundled with this release is recorded in <code>freemius/start.php</code> (<code>$this_sdk_version</code>).

Alternative Plugins for

Discover the Lists with Segurium – Free Malware Removal & Antivirus Scanner, Hacked Website Cleanup, Firewall, 2FA