Launching WPSniffer-what’s your go-to when a WordPress server gets hacked?

Hey Product Hunt 👋

I’m Chris. I’ve spent 9+ years in cybersecurity and cleaned up more than 180 compromised WordPress sites in the last 12 months alone. Almost every one of those jobs started the same way: SSH into the server and figure out which files have been tampered with, fast.

That’s why I built WPSniffer, an open-source, YARA-based malware scanner you run directly on the server from the command line. Think of it as a lightweight alternative to Wordfence CLI: no plugin to install inside a site that’s already compromised, and it can sweep every WordPress install on the box in one pass.

We launch tomorrow, and before then I’d love to hear from people who deal with this regularly:

1. When a client’s site gets hacked, what’s the first tool you reach for?

2. Do you scan on the server, through a plugin, or with an external service?

3. What’s the one thing your current scanner gets wrong (false positives, speed, missed backdoors, pricing)?

Every answer goes straight into the roadmap. Thanks!