Curious. I know it's for free, but #WordPress plugin #JetpackProtect from #Automattic for detecting malware found zero hits on a website where simple grep and some knowledge shows clearly four infected files.
Take care of your websites...
https://wordpress.org/plugins/jetpack-protect/
Jetpack Protect

Free daily malware scanning and WordPress site security. Jetpack Protect leverages the extensive database of WPScan, an Automattic brand, that has ove …

WordPress.org
@MichalBryxi Jetpack protect does nothing whatsoever to "scan your site". What were you expecting it to do?

@otto42 I did not try it personally as I currently administer zero WordPress instances. It was my friend who was supposed to use it on his website.

But the plugin description says: "Jetpack Protect is a free and essential WordPress security plugin that scans your site and warns you about vulnerabilities, ..."

How did I misinterpret that? Sure malware!= vulnerability. But if there are zero vulnerabilities, one could argue that there is no way for malware to get in 🧐

@otto42 *intentionally ignoring password brute force attacks and external code modifications as an option