Back to Community
Home / Community / General

Troubleshooting Common Sucuri Malware Scanner Errors

22 threads Sep 16, 2025

Content

Many WordPress administrators rely on the Sucuri Security plugin for its robust malware scanning capabilities. However, users occasionally encounter errors that prevent scans from running or displaying results correctly. This guide compiles the most common issues and their solutions, based on community support threads.

Common Malware Scanner Issues and Solutions

1. SSL Certificate Errors

Symptoms: Errors mentioning "SSL peer certificate or SSH remote key was not OK" or "certificate subject name does not match target host name".

Cause: These errors are typically caused by a misconfiguration on your web server, often involving an outdated version of OpenSSL or the use of self-signed certificates.

Solution: Navigate to the Sucuri plugin's general settings page. Locate the option labeled "API request with SSL" and change its value to "Stop peer’s cert verification". This will force the plugin to send requests over HTTP instead of HTTPS. For a permanent fix, contact your hosting provider and request they update the server's OpenSSL software.

2. Timeout and 500/502 Errors

Symptoms: Scans result in "500 Internal Server Error", "502 Bad Gateway", "Gateway Timeout", or a blank white screen.

Cause: These errors often occur when the server's PHP maximum execution time or memory limit is too low for the scan to complete, especially on larger sites. A timeout can also corrupt the scan's cache file.

Solution:

  • Ask your hosting provider to increase the PHP maximum execution time and memory limit.
  • In the plugin's general settings, increase the "API request timeout" value to more than the default 90 seconds.
  • If a scan times out and subsequent scans show no results, manually reset the cache. Go to the Scanner Settings page and find the "Malware Scanner Cache" panel to clear it.

3. Scan Runs But Shows No Results or Old Results

Symptoms: The scan appears to run but displays no results, or it continues to show malware on a page that has been deleted.

Cause: This is almost always a caching issue. The plugin stores scan results for 20-30 minutes. If an initial scan failed or retrieved empty data, it will cache that empty result.

Solution: Wait for the cache to expire (20-30 minutes) or manually reset it using the button in the "Malware Scanner Cache" panel within the plugin's Scanner Settings. If old malware alerts persist for deleted pages, the malicious code might be hiding in your site's custom 404 error page. Scan your website for hidden 404 rules.

4. Scan Redirects or Shows a Blank Public Page

Symptoms: Clicking "Scan Website" redirects you to a public-facing page with a URL like /wp-admin/admin.php?page=sucuriscan_scanner.

Cause: This is the intended behavior for the form submission that triggers the scan. The results are then cached for 30 minutes.

Solution: Use your browser's back button to return to the admin dashboard where the results will be displayed. This is normal plugin operation.

5. API and Cache Write Errors

Symptoms: Errors stating "Could not cache the malware scan results" or issues with API calls.

Cause: The plugin cannot write to the wp-content/uploads directory to save cache files, often due to incorrect file permissions.

Solution: Ensure the wp-content/uploads directory has write permissions (e.g., 755 for directories, 644 for files).

Alternative Scanning Method

If you are unable to resolve an issue with the plugin's scanner, you can use the external Sucuri SiteCheck service directly. This is the same engine the plugin uses and will provide identical results.

Simply visit https://sitecheck.sucuri.net/ and enter your website URL.

Important Note on Third-Party Integrations

If you are running a Sucuri scan from within another plugin (like iThemes Security) and encounter an error, you must contact the support team for that plugin. The 'Sucuri Security – Auditing, Malware Scanner and Security Hardening' team does not support code implemented by other developers.

By following these troubleshooting steps, you should be able to resolve the majority of issues preventing the Sucuri Malware Scanner from working correctly on your WordPress site.

Related Support Threads Support