Core Scanner checks WordPress core files for modifications, missing files, and unknown files. Sometimes you want to hide a known-safe finding, such as a server error_log or a file your host adds on purpose.

Ignore from scan results (easiest)

Go to Security Ninja → Core Scanner and run Scan Core Files.
On a finding, click Ignore and confirm.
Run a new scan if you want to refresh the summary.

Ignored files leave the problem sections and the tab badge count. They appear in the Ignored files section at the bottom of the results so you can see what you hid.

On Multisite, Ignore lists and scan results are shared across the network because core files are shared.

Only ignore files you are sure about. Ignoring a critical unknown file can hide real malware.

Ignore with a code filter (patterns and bulk rules)

For wildcards, whole directories, or many paths at once, use the securityninja_core_scanner_ignore_files filter in a child theme’s functions.php or a small custom plugin.

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'wp-includes/SimplePie/src/Core.php';
    $ignored[] = '*/error_log';
    return $ignored;
});

After you save the code, run a new Core Scanner scan. Filter-based ignores also show in Ignored files.

Need help adding custom code? See Add custom code to your website.

Pattern options

Exact path (relative to the WordPress root):

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'wp-includes/SimplePie/src/Core.php';
    return $ignored;
});

Wildcards (* matches any characters):

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = '*/error_log';
    $ignored[] = 'wp-includes/SimplePie/*';
    $ignored[] = 'wp-admin/*.tmp';
    return $ignored;
});

Basename only (any location with that filename):

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'error_log';
    $ignored[] = '.htaccess';
    return $ignored;
});

Directory prefix (that folder and its contents):

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'wp-includes/SimplePie/';
    return $ignored;
});

Common examples

Ignore a SimplePie false positive after some WordPress updates:

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'wp-includes/SimplePie/src/Core.php';
    return $ignored;
});

Ignore error logs:

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = '*/error_log';
    $ignored[] = 'error_log';
    return $ignored;
});

Ignore several specific files:

add_filter('securityninja_core_scanner_ignore_files', function($ignored) {
    $ignored[] = 'wp-includes/SimplePie/src/Core.php';
    $ignored[] = 'wp-admin/error_log';
    $ignored[] = 'wp-includes/debug.log';
    return $ignored;
});

Add a short comment above each pattern so you remember why it is ignored.

Troubleshooting

File still in results

Save the file that holds the filter, then run a new scan (old results do not refresh by themselves).
Copy the path exactly from the Core Scanner results (use forward slashes /).
Prefer a child theme or a code snippet plugin so theme updates do not wipe your filter.

Filter seems unused

Hook name must be exactly securityninja_core_scanner_ignore_files.
Confirm there are no PHP syntax errors (check the site error log).
Test with one exact path first.

Pattern not matching

Confirm the filter works with an exact path, then try wildcards.
Matching is case-insensitive in the plugin, and paths are normalized to forward slashes.

Technical details

Filter hook: securityninja_core_scanner_ignore_files
Pattern matching: fnmatch() for wildcards, with exact and basename fallbacks
Case sensitivity: matching is case-insensitive
Path normalization: backslashes become forward slashes before comparison

Still stuck? Contact support.

How to ignore files