MalCare review: WordPress malware scanning, cleanup and firewall
MalCare is a WordPress security plugin from BlogVault that scans your site for malware on its own servers, cleans infections in one click and blocks attacks with a firewall. It has a free plan with weekly scans and paid plans from $99 per year for one site, with a 14-day refund window.
No extra sign-up bonus — the provider's standard offer applies.
Disclosure: this is an affiliate link. If you sign up through it, we may earn a commission at no extra cost to you. The bonus and terms are set by MalCare and can change — check them on the official site before you sign up.
How to get started
- Open malcare.com through the link on this page; no code is needed.
- Create an account and add your WordPress site by installing the MalCare plugin.
- Run the first scan on the Free plan to see whether malware is found.
- If you want cleanup, the advanced firewall or more frequent scans, pick Protect, Repair or Fortify for 1 or 5 sites.
- If the plan does not suit you, request a refund within 14 days of purchase (not available once MalCare has cleaned malware from your site).
What is MalCare and what does it do for your site?
MalCare is a security service for WordPress, built by BlogVault and protecting WordPress sites since 2014. MalCare says it protects 400,000+ sites in 120 countries. You install a plugin, and the heavy work happens on MalCare's servers rather than on your hosting account, so scans do not eat into your site's resources.
What you get:
- Malware scanner that checks files, database tables and scheduled tasks. MalCare claims a 0.2% false-positive rate.
- One-click cleanup that removes malicious code while leaving posts, pages and design unchanged. It takes a backup first and re-scans afterwards to confirm the site is clean.
- Firewall that blocks harmful requests instead of only logging them, uses attack data from the wider network of protected sites, and includes country-level blocking.
- Login protection and 2FA for admin users, vulnerability alerts and SSL monitoring.
- Support: a Help Center, documentation and an API reference, with expert response times of 72 hours on Free down to 6 hours on Fortify.
Who MalCare is for
- Site owners with a hacked or suspicious site who want malware found and removed without editing files by hand.
- Small business and blog owners who want a scanner and firewall running in the background on a WordPress site.
- WooCommerce and membership sites where downtime or a malware warning costs customers.
- Freelancers and agencies: you can put different plans on different sites in one account, and agencies with 10+ sites can ask sales for agency pricing.
- Anyone on a tight budget who wants to start on the Free plan, which needs no credit card.
MalCare pricing and free plan
MalCare lists prices in USD, billed annually. Paid plans are priced for 1 site or 5 sites.
| Plan | 1 site / 5 sites per year | Scans | Malware cleanup | Expert response |
|---|---|---|---|---|
| Free | $0 | Weekly | No (detects only) | Within 72 hours |
| Protect | $99 / $299 | Every 24 hours | No (detect and alert) | Within 48 hours |
| Repair | $299 / $899 | Every 12 hours | Automated cleanup with report | Within 24 hours |
| Fortify | $499 / $1,499 | Hourly | Cleanup plus unlimited manual fixes | Within 6 hours |
The Free plan includes a basic firewall, login protection, vulnerability alerts, SSL monitoring and 2FA for 2 admin users. Protect adds the advanced firewall, virtual patching, geo-blocking, bot protection and custom rules. Repair adds instant cleanup and a post-cleanup report. Fortify adds unlimited manual fixes, help recovering a site suspended by a host, a redirection scanner, a server cron-job scanner and an annual website audit.
The pricing page does not mention a separate free trial; the Free plan is the way to try MalCare. You can upgrade or downgrade at any time, with the price difference prorated for the rest of your billing year.
Why choose MalCare
Many WordPress security plugins scan from inside your site and slow it down, or only tell you that something is wrong. MalCare's pitch is different: scanning runs on its servers, and cleanup is part of the paid Repair and Fortify plans rather than a separate job you hire out. The firewall blocks requests instead of just logging them, and plans scale from a free scanner to hourly scans with unlimited manual fixes.
Good to know before you buy
- Only Repair and Fortify remove malware. Free and Protect find and alert; if you need cleanup, start at Repair.
- Refund limits: refunds are available within 14 days, but not if MalCare has already cleaned malware from your site in that window.
- WordPress only. MalCare is a WordPress service.
- Pricing is annual; the page does not list monthly prices.
- There are no setup or cancellation fees, and you can cancel the next renewal from your dashboard.
Pros and cons
Pros
- Scanning runs on MalCare's servers, not your hosting
- One-click cleanup with backup first and a re-scan afterwards
- Free plan with no credit card required
- Firewall blocks requests and includes country-level blocking
- Clear 14-day refund window
Cons
- Free and Protect plans do not remove malware
- Paid pricing is annual only, from $99 per year for one site
- Refund is not available once a cleanup has been done
- WordPress sites only
Frequently asked questions
Is there a MalCare promo code or discount?
There is no sign-up bonus attached to the link on this page. Start on the Free plan, or buy a paid plan and add a coupon at checkout only if you have one.
Is MalCare free?
MalCare has a Free plan with no credit card required: weekly scans, a basic firewall, login protection, vulnerability alerts, SSL monitoring and 2FA for 2 admin users. It finds malware but does not remove it.
How much does MalCare cost?
Protect is $99 per year for 1 site or $299 for 5 sites, Repair is $299 or $899, and Fortify is $499 or $1,499. All prices are in USD and billed annually.
Is MalCare legit and safe?
MalCare is built by BlogVault, says it has protected WordPress sites since 2014 and publishes plan details, a refund policy and a Help Center. As with any plugin, keep your own backups.
Can MalCare remove malware from a hacked WordPress site?
Yes, on the Repair and Fortify plans. Cleanup removes malicious code, takes a backup first and re-scans afterwards. Free and Protect only detect and alert.
How do I cancel or get a refund?
You can cancel the next renewal from your dashboard with no cancellation fee. Refunds can be requested within 14 days of purchase, except where MalCare has already cleaned malware from your site.