Sometimes the scanner flags a legitimate file as suspicious or malicious. Here is how to handle it.
What "false positive" means
A false positive is a legitimate file that matches a pattern commonly seen in malware:
- Heavy obfuscation (some commercial plugins use it to protect their code)
- Encoded data (base64 fonts or encoded asset bundles)
- Dynamic code execution (
eval,assert— rare in legitimate code, but it exists) - A PHP file in an unusual place (for example a plugin that writes cache files into uploads)
How to tell
Open the site in Central and look at Findings → Malware, or in WordPress open PowerSEC → File Scanner → Malware scan. For each flagged file, check:
- File path — does it belong to a plugin or theme you installed and trust?
- Why it was flagged — the rule that matched and the explanation shown with it
- When it appeared — has it been there since the plugin was installed, or did it appear recently?
- The official copy — if the plugin comes from WordPress.org, compare the file with the same version downloaded from there
A file that belongs to a plugin from WordPress.org or a reputable seller, and has been there since you installed it, is often a false positive. Still, check it: attackers also hide code inside plugin folders.
Ask us to review it
In Central, open Findings → Malware and click Request review next to the file. We receive the file's hash and path (not its contents) and your note. If we confirm it is safe, we stop that exact file from being flagged — matched by its content hash, so a modified copy is still detected.
The scanner never deletes, moves or hides a finding on its own. A finding stays visible until it is resolved or reviewed.
Quarantine while you decide
If you are not sure, you can quarantine the file. Quarantine moves it to wp-content/uploads/powersec-quarantine/, where it can no longer run: it is renamed to a random name ending in .quarantine, with no .php left in it, so no web server — Apache, nginx or LiteSpeed — hands it to PHP. You can restore it from the same screen.
- In WordPress (every plan): PowerSEC → File Scanner → Malware scan, then Quarantine on the file's row.
- From Central (Pro Protection, Pro + Backup Plus, Agency): use Quarantine on the flagged file on the site page.
Quarantine can break a plugin if the file was legitimate. Take a backup first. If a quarantined file turns out to be needed, reinstall the plugin or theme it belongs to, or restore it from a backup.
When you are not sure
- Leave it in place or quarantine it; do not delete it yet
- Open a ticket with the file path, the plugin or theme it seems to belong to, when you noticed it, and whether the site has had a recent compromise
- We will review it and advise. We aim to reply within 1–2 business days
If you keep seeing false positives on one plugin, let us know. We can often adjust a signature for everyone.