Should I just delete the file?

Not as your first move. Note the path and timestamp, and check whether it belongs to a plugin or theme before removing it — deleting a live component breaks the site and destroys evidence. If it is clearly foreign (a PHP file in uploads/ almost always is), quarantine it, then look for how it got there: one dropped file usually means a vulnerable entry point that will just re-create it.

How do I tell a false positive from real malware?

Read what the signature matched and where the file lives. Obfuscated code inside a paid plugin's own directory, shipped by the vendor, is the classic false positive. The same obfuscation in uploads/, wp-includes/, or a file whose name imitates core (wp-cache.php, wp-mail.php in the wrong place) almost never is. When in doubt, compare against a fresh copy from the vendor.

The file keeps coming back after I remove it. Why?

Something still on the site is re-dropping it — a second backdoor, a compromised admin account, a scheduled task, or the original vulnerability still unpatched. Recurring files mean the cleanup missed the entry point. At that stage restore from a known-clean backup and rotate every credential rather than playing whack-a-mole file by file.

Glossary · Malware

A file appears to be malicious

Wordfence type: file
Category: Malware
Severity: Critical

Wordfence's malware signatures matched the contents of a file on the site.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

File appears to be malicious or unsafe: wp-content/uploads/2024/06/cache.php

What Wordfence found

The malware scanner read the file and matched it against Wordfence's signature set. The finding names the path and usually the signature that fired. This is a content match on the file itself, not an inference from its name or location.

Why it matters

A signature match means known-bad code is present on the server. Whatever put it there had write access, which means the entry route is still open until you find it. Treat the site as compromised rather than as having one bad file.

How to fix it

1Do not simply delete the file and move on. Take a copy first if you need to investigate.
2Look for how it arrived: check the vulnerability findings on the same site, and the file's modification time against your deploy history.
3Restore affected paths from a known-clean backup taken before the modification date.
4Rotate every administrator password, every application password, and the database credentials.
5Regenerate the salts in wp-config.php to invalidate existing sessions.
6Re-scan until clean, then scan again a day later — reinfection within 24 hours means the entry route is still open.

Common questions

Should I just delete the file?: Not as your first move. Note the path and timestamp, and check whether it belongs to a plugin or theme before removing it — deleting a live component breaks the site and destroys evidence. If it is clearly foreign (a PHP file in uploads/ almost always is), quarantine it, then look for how it got there: one dropped file usually means a vulnerable entry point that will just re-create it.
How do I tell a false positive from real malware?: Read what the signature matched and where the file lives. Obfuscated code inside a paid plugin's own directory, shipped by the vendor, is the classic false positive. The same obfuscation in uploads/, wp-includes/, or a file whose name imitates core (wp-cache.php, wp-mail.php in the wrong place) almost never is. When in doubt, compare against a fresh copy from the vendor.
The file keeps coming back after I remove it. Why?: Something still on the site is re-dropping it — a second backdoor, a compromised admin account, a scheduled task, or the original vulnerability still unpatched. Recurring files mean the cleanup missed the entry point. At that stage restore from a known-clean backup and rotate every credential rather than playing whack-a-mole file by file.

Findings that often appear with this one

An unknown file was found in a WordPress core directory File change
A known malicious file was found Malware
The site is flagged by Google Safe Browsing Malware

How WPSecureOps treats it

The connector reports this as file. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.