lockedm
This is flagged by the integrity check module, not the malware protection module.
cPFence uses the native WordPress wp-cli integrity check. Whatever is reported by the WordPress checksum verification will also be flagged or quarantined by this module, depending on your settings.
You can test this manually by logging into the site container:
su - username
cd public_html/
(or the path where WordPress is installed)
Then run:
wp core verify-checksums
This will flag any file that is not part of the native WordPress core, or any plugin/theme file that does not follow WordPress best security practices.
You can whitelist any files or paths by editing the following files or using WebUI > Edit Config Files:
Integrity check exclusions (paths): /opt/cpfence/user-config/cpfowl/exclude_integrity_check_sites.txt
Integrity check exclusions (files): /opt/cpfence/user-config/cpfowl/exclude_integrity_check_files.txt
Best security practice is to keep the integrity check enabled, as it is a very powerful layer against hacking attempts, and simply whitelist file names or paths that you know are clean.
