Security tests on a site that is under maintenance, behind HTTP basic auth, or locked by a “coming soon” plugin can return false failures. Those layers often block or redirect the same public requests the tests use.
Why conflicts occur
Maintenance plugins typically intercept front-end requests. A test that visits a URL (for example readme.html) may see the maintenance page instead of the real file response. See Secure or remove readme.html and Fixed test results still fail.
Testing method
Some checks intentionally request the public URL rather than only reading the filesystem. That matches what an outside visitor would see, including cases where WordPress is partly hidden.
Firewall
You can leave the Security Ninja firewall enabled during maintenance. It still evaluates malicious requests that are not redirected away.
