Documentation & User Guide
Master guide to clean hacked sites, prevent recurring infections, and harden WordPress with zero performance lag.
Getting Started with Nexura Security
Nexura Security is designed with an Intelligent Zero-Config philosophy. The moment you activate the plugin from your WordPress dashboard, essential protections — including Web Application Firewall rules, brute-force IP throttling, and upload shielding — activate immediately.
Search for "Nexura Security" in Plugins > Add New and activate.
Navigate to Malware Scanner and click "Start Scan" to audit files.
Open Reinfection Guard to guarantee malware cannot regenerate.
Lightweight Promise: Nexura uses micro-batching background threads. It will never slow down your site visitors or overload your database with millions of unnecessary query rows.
Why WordPress Malware Keeps Returning (And How to Fix It)
One of the most common and infuriating problems for WordPress website owners: you clean the infected files, delete the backdoors, and within 24–48 hours the malware reappears. Why? Because hackers plant Persistence Vectors designed to re-download or recreate the backdoor automatically.
The 5 Persistence Vectors Used by Hackers:
- 1. Malicious WP-Cron Tasks: Stealth background jobs scheduled in WordPress that run daily to fetch new malware code.
- 2. Rogue Drop-in Scripts: Unauthorized
advanced-cache.phpordb.phpfiles that execute before WordPress finishes loading. - 3. Hidden Must-Use (MU) Plugins: PHP scripts placed in
wp-content/mu-plugins/that cannot be deactivated from the standard plugins list. - 4. Obfuscated Uploads Executables: PHP files masquerading as images inside
wp-content/uploads/subdirectories. - 5. Database Base64 Injections: Payloads stored in
wp_optionsthat execute via PHPeval()on every page load.
Step-by-Step Eradication Workflow:
Go to Nexura Security > Malware Scanner. Run a full site scan and click "Clean" on all flagged infected files and backdoors.
Navigate to Nexura Security > Reinfection Guard and click "Analyze Site-Wide Persistence". Nexura inspects all 5 layers simultaneously.
In the Persistence Mechanisms Table, review each identified vector and click "Remediate" to remove rogue crons, unauthorized drop-ins, or unapproved scripts.
Once persistence is cut off, update all administrator passwords and use 2FA to prevent attackers from re-authenticating.
How to Remove "Deceptive Site Ahead" or "Site Contains Harmful Programs"
When Google Safe Browsing detects phishing scripts, deceptive redirects, or malware on your domain, Chrome displays a bright red warning screen blocking all visitors. Follow this verified guide to remove the blacklist within 24–72 hours:
Eliminate All Infected Files
Run a Deep Malware Scan with Nexura. Make sure all malicious JavaScript redirects (such as Balada Injector or ClearFake) are thoroughly cleaned.
Clean Injected Database Transients & Options
Hackers often inject deceptive spam links directly into your database. Use Nexura's DB Security tool to scan wp_posts and wp_options for hidden scripts.
Submit Review Request to Google Search Console
Open Google Search Console and select your property.
Navigate to Security & Manual Actions > Security Issues.
Click "Request Review". Provide a concise explanation: "We have scanned our entire WordPress installation with Nexura Security, removed all infected files and backdoors, secured our administrator accounts with 2FA, and verified our site is clean."
Pro-Tip: Use the built-in Google Safe Browsing Check in Nexura Security to track your blacklist removal status directly from your WordPress admin dashboard.
White Screen of Death (WSOD) & Fatal Error Auto-Heal
A single PHP syntax error in a newly installed plugin or theme can crash your entire WordPress website, leaving visitors with a blank white screen. Nexura Security includes native Fatal Error Auto-Heal technology:
How Fatal Error Auto-Heal Protects You
Nexura installs a special WordPress drop-in file (wp-content/fatal-error-handler.php). When an unhandled fatal error or memory exhaustion occurs:
- ✔ The drop-in intercepts the crash before the White Screen of Death displays.
- ✔ It identifies the exact plugin or theme file causing the fatal error.
- ✔ It safely isolates the crashing plugin and immediately reloads the page so your visitors never experience downtime.
- ✔ An admin notification is displayed detailing the crash location and error trace.
2FA Lockout Recovery: Lost Your Phone or Authenticator?
If you lost your mobile device or deleted your authenticator app, don't worry. Nexura Security provides multiple fail-safe recovery pathways:
Method 1: Backup Recovery Codes
When you set up 2FA, Nexura provides 8 emergency backup codes. On the 2FA login prompt, click "Use a recovery code" and enter one of your single-use codes.
Method 2: Passwordless Magic Link
If Magic Link login is enabled on your site, request a secure sign-in link sent to your registered administrator email address.
Reinfection Guard & Root Cause Analyzer 100% FREE
Standard security plugins only delete malware files. They leave behind the hidden roots — persistent cron jobs, stealth drop-ins, and backdoor downloaders — causing malware to return over and over. Nexura's Reinfection Guard is the first free tool that investigates and severs malware persistence at the architectural level.
Central infected or targeted node
Rogue scripts, crons & drop-ins
Neutralize vectors from table
🔍 5-Phase Deep Investigation
Orchestrates 5 specialized detectors: File-System Persistence (Drop-ins & MU-plugins), Code-based File Writers, Dynamic WP-Cron Analyzer (using PHP Reflection), Database Injections, and Server Configuration Tampering.
🌐 60,000+ Plugin Ecosystem Support
Unlike naive scanners with hardcoded lists, Nexura dynamically inspects callback origins via PHP Reflection and active plugin registries. Custom plugins from any third-party developer are recognized with zero false positives.
How to Run an Investigation:
- Go to Nexura Security > Reinfection Guard in your admin sidebar.
- Click "Analyze Site-Wide Persistence" (or enter a specific infected file path).
- Watch the real-time progress bar across all 5 analysis phases.
- Review the interactive attack vector nodes and persistence table.
- Click "Remediate" to instantly quarantine and neutralize any threat vector.
Malware Scanner & 1-Click Cleaner
Deep Heuristic & Signature Scanning
Nexura scans your entire WordPress file system — core files, themes, plugins, and media uploads — against millions of malware signatures, web shell patterns (WSO, B374k), trojans, and obfuscated JavaScript injectors (Balada, Sign1, WP-VCD).
One-Click Cleaning: Clean malicious injections directly from the scanner results without touching FTP or terminal.
Micro-Batching Engine: Processes files in small, non-blocking batches so your server stays cool and fast.
Edge Firewall (WAF)
Pre-Boot Threat Interception
Nexura's Web Application Firewall loads via auto_prepend_file — executing before WordPress even boots up. Malicious SQL injections (SQLi), Cross-Site Scripting (XSS), and Remote File Inclusions (RFI) are intercepted and dropped before they can touch your database.
Cloudflare Integration: Connect your Cloudflare account to push blocked attacker IP addresses directly to Cloudflare's global edge network.
One-Click Security Hardening
Lock down your WordPress installation in under 60 seconds with industry-standard hardening toggles:
- Disable File Editor: Prevents hackers with stolen admin credentials from editing theme/plugin PHP code directly in wp-admin.
- Block PHP Execution in Uploads: Disables execution of any PHP script inside
/wp-content/uploads/— neutralizing 95% of uploaded web shells. - Disable Directory Browsing: Prevents attackers from viewing lists of files in your site folders.
- Block XML-RPC Attacks: Eliminates brute-force amplification attacks targeting
xmlrpc.php. - Block REST API User Enumeration: Hides username endpoints so automated bots cannot harvest your login usernames.
Two-Factor Authentication (2FA) & Brute-Force Defense
Rock-Solid Login Protection
Even if an attacker guesses your password, 2FA ensures they cannot log in without the one-time time-based code generated by your phone (Google Authenticator, Microsoft Authenticator, Authy, or 1Password).
Intelligent IP Lockout: Automatically blocks IP addresses after repeated failed attempts. Customizable lockout duration, attempt thresholds, and whitelist rules.
Anti-Spam & Invisible Bot Defense
Privacy-First Cloudflare Turnstile & reCAPTCHA
Stop spam comments, fake registrations, and automated login attempts without annoying your real visitors. Integrated with privacy-friendly Cloudflare Turnstile and Google reCAPTCHA v2/v3.
Passwordless Magic Link Logins
Allow trusted users to sign in without typing a password. A secure, cryptographically signed, one-time link is sent to their verified email address — eliminating the risk of keystroke loggers and password theft entirely.
WooCommerce Security Suite PRO
Designed specifically for high-traffic eCommerce stores. Protects against:
- Checkout Card Testing: Stops botnets from testing stolen credit cards on your checkout page.
- Fake Customer Registrations: Invisible honeypots prevent bots from creating thousands of fake customer accounts.
- Cart & Coupon Abuse: Rate-limits coupon code testing to stop discount code scraping.
- Payment Gateway Whitelisting: Seamlessly whitelists incoming webhooks from Stripe, PayPal, and Mollie.
Database Scanner & Safe Optimizer PRO
Scans deep inside wp_options, wp_postmeta, wp_usermeta, and custom tables for hidden JavaScript injections, encoded PHP, and backdoor iframes. Includes one-click database optimization to remove transient bloat safely.
MaxMind Country Geo-Blocking PRO
Block entire countries where you do no business natively on your server. Uses the MaxMind GeoLite2 database to drop malicious requests instantly at the firewall level.
File Integrity Monitor (FIM) PRO
Continuously tracks file creations, modifications, and deletions across your WordPress core, theme, and plugin files. Receive instant notifications the second an unauthorized file change occurs.