How is this different from 'file appears to be malicious'?

Certainty. 'Appears malicious' is a pattern match, which can misfire; this is a hash match — the file is byte-for-byte identical to one in Wordfence's malware corpus. There is no legitimate file it could be confused with. Treat the site as compromised and start incident response, not just deletion.

So the site is definitely compromised?

The file did not walk there by itself, so yes — something put it on the server. What is not yet known is scope: how it got in, how long ago, what else was changed, whether credentials or user data were touched. Removing the file is the first minute of the response, not the whole of it.

What does a real cleanup involve?

Restore files from a backup that predates the intrusion or reinstall core, plugins and themes from source; audit users, scheduled tasks and recently modified files; rotate every password, salt and API key the site holds; patch the entry point; then re-scan. If the site takes payments or holds personal data, check whether disclosure obligations apply.

Glossary · Malware

A known malicious file was found

Wordfence type: knownfile
Category: Malware
Severity: Critical

A file on the site matches a known-bad file by hash, not just by pattern.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

This file is a known malicious file: wp-content/plugins/hello-dolly/wp-load.php

What Wordfence found

This is a hash match against files Wordfence has catalogued as malicious. It is a stronger signal than a pattern match: the file is byte-for-byte a known piece of malware, commonly a webshell or an uploader dropped after a successful exploit.

Why it matters

Because it is an exact match, the false-positive rate is very low. A webshell gives an attacker arbitrary command execution through a normal-looking HTTP request, which means persistence that survives plugin updates and password changes.

How to fix it

1Remove the file, but assume it is not the only one. Webshells are usually dropped in pairs or scattered across upload directories.
2Search the whole install for files with the same modification date.
3Restore from a clean backup if one exists from before that date.
4Rotate all credentials and regenerate salts.
5If the site handled personal data, work out whether the compromise triggers a disclosure obligation — that decision belongs to the site owner.

Common questions

How is this different from 'file appears to be malicious'?: Certainty. 'Appears malicious' is a pattern match, which can misfire; this is a hash match — the file is byte-for-byte identical to one in Wordfence's malware corpus. There is no legitimate file it could be confused with. Treat the site as compromised and start incident response, not just deletion.
So the site is definitely compromised?: The file did not walk there by itself, so yes — something put it on the server. What is not yet known is scope: how it got in, how long ago, what else was changed, whether credentials or user data were touched. Removing the file is the first minute of the response, not the whole of it.
What does a real cleanup involve?: Restore files from a backup that predates the intrusion or reinstall core, plugins and themes from source; audit users, scheduled tasks and recently modified files; rotate every password, salt and API key the site holds; patch the entry point; then re-scan. If the site takes payments or holds personal data, check whether disclosure obligations apply.

Findings that often appear with this one

A file appears to be malicious Malware
An unknown file was found in a WordPress core directory File change

How WPSecureOps treats it

The connector reports this as knownfile. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.