The Malware Scanner checks folders and files on your site for malicious code. Safe code can sometimes look malicious. That is a false positive.
A file marked as suspicious does not always contain harmful code.
Sometimes the match is clear and points to a known attack. Other times it is legitimate programming, or malicious code trying to hide.
If you see warnings or suspect a hack, start here: open the flagged files and review them before you delete anything.
We try to limit wrong matches, but we would rather show a few safe files than miss something dangerous. A flagged file means you should look closer, not that you must delete it.
For example, the scanner once looked for a simple footprint: the word “ShellBOT” in a file.
False positive detecting a script in a plugin
The word was found, but on closer inspection it came from the Theme Check plugin. That plugin looks for common worms, including the same phrase our scanner looks for. The file was safe.
Do not delete a file only because the scanner marked it. Deleting the wrong file can break part of your site, or the whole site.
If you confirm a real infection, follow the malware cleanup checklist.
