What it is

A file was found whose name or contents match known malware patterns — a random 8-character PHP file, code wrapped in matching marker comments, or a known backdoor function family. These usually hide obfuscated code that ordinary scanners miss.

How to fix it

Delete the flagged file (a backup is made first in case of a false positive) and scan the whole account for others like it, since they tend to come in groups. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

A malicious file has been found hiding on your website that tries to disguise itself so security programs won't notice it. This type of file is dangerous because it can give hackers a secret way to access your site, steal information, or damage your content without you knowing. Think of it like a burglar leaving a hidden key under your doormat so they can come back in whenever they want. The good news is that the file can be removed completely, though it's important to check for other similar hidden files since hackers usually plant more than one. The easiest fix is to let your WordPress security plugin automatically find and delete all these suspicious files for you, or if you're comfortable doing it manually, you can access your file manager and remove the flagged file. After removal, it's a good idea to run a full security scan of your entire website to make sure no other hidden files are lurking around.