WordPress plugin · free on WordPress.org
Every file of your WordPress, checked. And repaired in one click.
Unhack compares every file of WordPress core, your plugins and your themes with its official version, explains each problem in plain words and puts the right version back. Every repair can be undone in one click.
- No site data sent anywhere
- English and French
- One-time payment
A hacked site does not always show. Its files never lie.
- 822,651infected sites detected by Sucuri in 2024
- 11,334new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024
- 5 hmedian time between the disclosure of a vulnerability and its first exploitation
Sources: Sucuri, 2024 report; Patchstack, State of WordPress Security 2026.
How it works
Scan, understand, repair. No technical skills needed.
Scan
Every file is compared with the official reference of the exact version installed. Never with another version: no false alarms.
Understand
Each point is explained plainly: what is happening, why it matters, what to do. Added or removed lines are highlighted.
Repair, undo if needed
The official version is verified before use and the old file is kept for 30 days. One click takes you back.
Unhack in 2 minutes
Video description
The video, without sound, shows Unhack in the admin of a WordPress demo site.
1. The dashboard starts a scan: every file of core, plugins and themes is compared with its official version.
2. The results are listed by importance: a modified core file, code in the media library, a rule added to the .htaccess file…
3. The detail of a point explains what is happening, why it matters and what to do, with the added lines highlighted.
4. The repair puts the verified official version back and keeps a copy of the old file for 30 days.
5. One click on “Undo the repair” puts the file back as it was.
What Unhack checks
The whole site, including where others do not look.
WordPress core
Every file compared with the checksums published by WordPress.org, translated releases included.
Plugins
Compared with their exact version on WordPress.org. Premium plugins are fingerprinted at every installation.
Themes
Compared with the official package of their version. A displayed version that does not match the files is reported.
Sensitive files
Media, wp-config.php, .htaccess, .user.ini, must-use plugins, folders at the root: the favourite hiding places of intruders.
No needless false alarms. Translations, localised releases and cache files are recognised.
Never “site clean”. Unhack says honestly what it checked, and what it could not check.
Light. Nothing runs during visits: the scan starts when you decide, in small steps.
Comparison
What makes the difference.
Unhack does not replace your firewall: it checks and repairs the files, where whatever already got in hides.
| Unhack | Wordfence | MalCare | Sucuri | SecuPress | |
|---|---|---|---|---|---|
| Comparison with the exact official version | Yes core, plugins, themes | Yes | Yes | core only | core only (Pro) |
| Repair of official files | Yes free | Yes free | Yes paid (from $299 / year) | Yes core free; cleanup paid | core (Pro); human cleanup from €299 |
| Undo of every repair | Yes for 30 days | — (backup download) | safety backup before cleanup | No | not checked |
| Rescue tool when the site no longer opens | Yes without WordPress | No | Yes off-site scan | remote scan; server-side scanner (paid) | No |
| Pricing model | one-time payment | subscription | subscription | subscription | subscription |
| Price of the full version | €49 once | $149 / site / year | $99 to $499 / site / year | $229 to $549 / site / year | €60 / site / year |
Source and date of each row
- Comparison with the exact official version: WordPress.org listings, product pages and documentation of Wordfence, MalCare, Sucuri and SecuPress. (2026-09-25)
- Repair of official files: Product and pricing pages of the vendors (wordfence.com, malcare.com, sucuri.net, secupress.me). (2026-09-25)
- Undo of every repair: Documentation of Unhack, Wordfence, MalCare and Sucuri (and the code of the Sucuri plugin). Not checked for SecuPress. (2026-09-25)
- Rescue tool when the site no longer opens: Product pages and documentation of Wordfence, MalCare, Sucuri and SecuPress. (2026-09-25)
- Pricing model: Pricing pages of the vendors. (2026-09-25)
- Price of the full version: Pricing pages of the vendors (wordfence.com, malcare.com, sucuri.net, secupress.me). (2026-09-25)
Pricing
Pay once. Keep it forever.
No subscription. One licence per site, for life, updates included. Your staging and test sites are included.
Free
€0
To check and repair your site, file by file.
- Full scan of the site
- Plain explanations, line-by-line comparison
- File-by-file repair from WordPress.org
- Undo for 30 days
- Command-line rescue tool
Pro
Launch price€491 site, for life
To get a site back on its feet quickly.
- Everything in Free
- Bulk repair, up to 50 files at once
- FTP rescue tool, in your browser
- Updates and e-mail support
- Soon: references for premium plugins
Agency 5
€1495 sites
About €30 per site. For freelancers and small agencies.
- 5 Pro licences for life
- One key per site
- Move to another site 3 times a year
Agency 25
€44925 sites
About €18 per site. For agencies looking after many sites.
- 25 Pro licences for life
- One key per site
- Move to another site 3 times a year
Prices include VAT. Secure payment by Paddle, the official reseller (Merchant of Record), which handles VAT and sends your invoice.
Rescue tool
Your site no longer opens? The rescue tool works without WordPress.
A single file, uploaded by FTP or run from the command line. It scans the site without loading WordPress, so an intruder hiding inside cannot fool it, and repairs from the official copies.
Read the guide$ php unhack-rescue.php scan /var/www/mysite [42/42] done · 7,271 files checked CRITICAL wp-content/uploads/2026/09/sitemap-demo.php HIGH .htaccess · rule pointing to code in the media HIGH contact-form-7 · displayed version ≠ files Verdict: action needed (3 points)
Frequently asked questions
You may be wondering…
Does Unhack replace my security plugin?
No, it complements it. A firewall tries to stop intrusions; Unhack checks the files and repairs what was changed. Keep both.
Is my data sent anywhere?
The free version only contacts WordPress.org, to get the official references. No data about your site or your visitors is sent.
What about my premium plugins?
Unhack records a reference copy of their fingerprints at every installation or update made from WordPress: any later change is detected.
Does Unhack clean the database?
No: Unhack checks and repairs files. If the database is affected, call an expert.
Does it slow my site down?
No. Nothing runs during visits: the scan starts when you decide, in small steps, even on modest hosting.
Contact
A question? We will answer.
Before buying, for a problem or for an agency: write to us. We answer within 24 business hours.
- Support · support@unhack.fr
- Report a vulnerability · security@unhack.fr