When PowerSEC scans your site, suspicious files get one of these verdicts:
clean
The file matches a known-good signature (WordPress core, official plugin, or your committed code). No action needed.
low risk (unconfirmed)
Heuristics suggest the file is benign but it doesn't match a known signature — it may be a legitimate custom theme/plugin file. Review it if it's in an unexpected location. On eligible protection plans, AI Advisory can add an advisory second-opinion verdict on flagged files (it never changes the scanner's verdict).
suspicious
Contains patterns that could be malicious (eval, base64_decode, obfuscation) but might also be legitimate code. Recommended action: review the file in context. If it's part of a plugin you trust, you can mark it as a false positive.
likely_malicious
Strong indicators of malware: heavy obfuscation, known malicious function patterns, or file in an unusual location. Recommended action: quarantine the file immediately and investigate.
confirmed_malicious
File hash matches a known malware sample in PowerSEC's signature database OR multiple sites have flagged this hash. Recommended action: quarantine, restore from a clean backup, and investigate how the file got there.
Common malware families
- WSO Web Shell — generic PHP backdoor giving attacker file/DB/exec access
- FilesMan — file manager backdoor
- Marijuana Shell — older PHP web shell
- C99 — classic PHP shell, still appears occasionally
- Anonymous Fox — recent SEO-spam injector targeting WP
- Balada Injector — large-scale WP campaign that injects JS redirects
False positives
Some legitimate code triggers heuristics:
- Plugin auto-update routines using
eval()for hooks - Encoded fonts in theme files (base64 in CSS/JS)
- Encrypted license-checking code in commercial plugins
If you're confident a flagged file is safe, click "Mark as false positive" in the alert. PowerSEC learns from your feedback to reduce future false positives.
What to do with a malicious file
- Quarantine it — moves the file to
wp-content/powersec-quarantine/(still recoverable but no longer executes) - Investigate the entry point — how did the attacker upload this? Often a vulnerable plugin
- Restore from backup — if multiple files were modified, restore from before the infection
- Patch the entry point — update the vulnerable plugin or remove it
- Reset all admin passwords — assume any saved sessions are compromised
- Re-scan — confirm everything is clean
How much does a scan review?
Your site's Findings → Malware scan-coverage box shows "Files reviewed in last malware scan" — the number of PHP and executable files the scanner reviewed during the last scan, whether pattern-inspected or checksum-verified against known-good baselines. The count is honest by design: paths you intentionally exclude are not scanned (and not counted), very large files may be sampled (reported separately as partial coverage), and the count appears after your site's next scan on plugin v1.4.121 or later. A scan reviewing thousands of files is normal — most simply match the official WordPress and plugin checksums.
For step-by-step recovery, see Recovering from a malware infection.