Use GOTMLS to Scan for Suspicious Files (and Avoid False Positives)

What this covers: Running scans, interpreting “potential threats,” and next steps.

Steps

1. Go to GOTMLS → Scan (menu name may vary).

2. Update definitions (if the plugin offers updates) before scanning.

3. Start a full scan (include theme + plugin directories).

4. Review the results list and note:

   • File path

   • Type of match (obfuscation, eval, base64 patterns, etc.)

5. Check for false positives:

   • Some minified JS or legit libraries can look suspicious.

6. If a file is truly suspicious:

   • Compare it to a known-clean version (plugin/theme vendor copy)

   • Replace the file by reinstalling the plugin/theme from a trusted source

7. Re-scan after cleanup.

8. If reinfection happens:

   • Rotate admin passwords, SFTP/hosting passwords, and review admin users.