---
title: False negative
canonical: https://wpsecurityninja.com/dictionary/false-negative/
---
# False negative

A false negative is a real security problem that a tool or process failed to detect.

Last updated: 2026-08-26

Also called: false negatives

## Related terms

- [False positive](https://wpsecurityninja.com/dictionary/false-positive/): A false positive is an alert that looks like a problem but turns out to be benign after review.
- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- [File integrity monitoring](https://wpsecurityninja.com/dictionary/file-integrity-monitoring/): File integrity monitoring checks whether important files changed compared with a known-good baseline.

[Full guide](https://wpsecurityninja.com/malware-kept-coming-back/)

## FAQ

### How is a false negative different from a false positive?

A false positive flags something clean as bad. A false negative misses something that really is bad. Green scan results can still be false negatives when visitors see spam or reinfection continues.

### What should I trust if the scanner is clean but the site looks hacked?

Trust the symptoms. Check logs, core file integrity, users, and cron. Scanners help, but they are not proof the site is clean when redirects, new admins, or host notices say otherwise.

## Why it matters for WordPress

A green “no malware found” badge feels great. It is not proof the site is clean. New backdoors, clever obfuscation, and database-only injections get missed. Pair scanners with integrity checks, logs, and human review when symptoms disagree with the report.

## How it shows up in practice

- Visitors still see spam redirects while the scanner stays green
- A host blacklist notice after your plugin said everything was fine
- Reinfection from a persistence mechanism no signature knew yet
- A known vulnerable plugin version that a misconfigured scan never listed

## What to do

1. Treat scanner output as evidence, not gospel.
2. If users report odd behavior, investigate anyway: logs, core diffs, users, cron.
3. Combine malware scanning with file integrity and vulnerability checks.
4. After cleanup, keep watching; false negatives love to show up on day two.