When PowerSEC's scanner flags a file, it gives the finding a severity and tells you which rule matched and why. A finding is a signal for review, not proof: legitimate code can occasionally look like malware.
Severity
- Critical — strong indicators of a web shell or backdoor, such as code that runs commands sent in a request
- High — patterns very often used by malware, such as obfuscated code that is decoded and then run
- Medium / low — patterns that could be malicious but are also found in legitimate code
Recommended action: review every critical and high finding promptly. For medium and low findings, check whether the file belongs to a plugin or theme you trust.
On eligible plans (Pro Protection, Pro + Backup Plus, Agency), AI Advisory can add a second opinion on selected findings after you turn it on. It never changes the scanner's result.
Common malware families
- WSO Web Shell — generic PHP backdoor giving an attacker file, database and command access
- FilesMan — file manager backdoor
- Marijuana Shell — older PHP web shell
- C99 — classic PHP shell, still seen occasionally
- Anonymous Fox — SEO-spam and account-takeover campaign targeting WordPress
- Balada Injector — large-scale WordPress campaign that injects JavaScript redirects
False positives
Some legitimate code matches malware patterns:
- Plugins that use
eval()to run templates - Encoded fonts or assets in theme files
- Encrypted license-checking code in commercial plugins
If you think a flagged file is safe, click Request review next to it under Findings → Malware. See False positives in malware scans.
What to do with a malicious file
- Quarantine it — moves the file to
wp-content/uploads/powersec-quarantine/, where it can no longer run: it is renamed to a random name ending in.quarantine, with no.phpleft in it, so no web server — Apache, nginx or LiteSpeed — hands it to PHP. Do this in WordPress under PowerSEC → File Scanner (every plan) or from Central (Pro plans). PowerSEC never quarantines a file on its own - Find the entry point — how did it get there? Often an outdated or vulnerable plugin
- Restore from backup — if several files were changed, restore a backup from before the infection
- Close the entry point — update or remove the vulnerable plugin
- Reset all administrator passwords and log out other sessions
- Scan again to check that nothing else is flagged
How much does a scan review?
Your site's Findings → Malware scan-coverage box shows "Files reviewed in last malware scan" — the number of PHP and executable files the scanner reviewed during the last scan, whether pattern-inspected or checksum-verified against known-good baselines. Paths you intentionally exclude are not scanned (and not counted), very large files may be sampled (reported separately as partial coverage), and the count appears after your site's next scan on plugin v1.4.121 or later. A scan reviewing thousands of files is normal — most simply match the official WordPress and plugin checksums.
If you would rather have a security analyst clean the site, see Get help.