Monitoring Dictionary
False positive
Definition
A false positive is an alert that looks like a problem but turns out to be benign after review.
Also called: false positives
Why it matters for WordPress
Scanners and WAFs err on the side of caution. Treating every flag as malware wastes hours. Ignoring every flag because “tools cry wolf” is how real infections linger. The skill is verification, not blind trust or blind dismissal.
How it shows up in practice
- A malware scanner flags obfuscated but legitimate library code inside a plugin
- A core integrity alert right after a normal WordPress update
- Host antivirus quarantines a needed plugin file and breaks checkout
- A WAF blocks a payment webhook or a real customer’s unusual User-Agent
What to do
- Verify before mass-deleting: path, modification time, whether the code belongs to a known plugin version.
- Compare with a clean copy of the same plugin or theme release.
- Allowlist narrowly when you are sure; do not blank-allow whole directories.
- For WAF noise, tune the rule or path instead of turning the firewall off.
Related terms
Nearby ideas in the dictionary
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.
- False negative A false negative is a real security problem that a tool or process failed to detect.
- WordPress WAF A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
