Scanner says core files were modified? Open the diff. After wp2shell, that is often leftover access.

How to read it

Developers

How to Modify Blocked Hosts List

Customize hostname patterns for Filter Suspicious Queries when hostname reverse-DNS matching is enabled.

The blocked_hosts_items filter lets you add hostname fragments that Filter Suspicious Queries can match during hostname reverse-DNS checks.

Important: In current Security Ninja versions, hostname matching is off by default. URI, query string, user agent, and referrer rules still run without it. To use this filter, first enable hostname checks with secnin_cf_check_blocked_hosts.

User-facing guide: Filter Suspicious Queries.

Add a blocked hostname fragment

add_filter( 'blocked_hosts_items', 'filter_blocked_hosts_items' );

function filter_blocked_hosts_items( $hosts ) {
    $hosts[] = 'examplehost';
    return $hosts;
}

The filter looks for occurrences of the string in the resolved hostname. You can be as specific or broad as you need.

Not sure how to add this code? See Add custom code to your website.

Still stuck? Get help or contact us.

Larger screenshot

Enlarged image