Hi,
We scanned and received report, and need clarification from you, especially on wp-includes/html-api/html5-named-character-references.php scored 6000. Thank you and kind regards
#43482 PHP File Change Scanner Report
Posted in ‘Admin Tools for WordPress’
This is a public ticket
Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.
Environment Information
WordPress version
7.1.4
PHP version
n/a
Admin Tools version
n/a
Latest post by nicholas on Tuesday, 03 November 2026 08:06 CST
Tuesday, 03 November 2026 03:42 CST
System Task
system
The ticket information has been edited by Slobodan Cucak (bobdxb).
Tuesday, 03 November 2026 05:28 CST
nicholas
Akeeba Staff
Manager
Before I reply, I want you to tell me if you've read https://www.akeeba.com/documentation/atwp/php-file-scanner-reports.html, what you've done to evaluate this file, and whether you had previously marked it as safe.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
Tuesday, 03 November 2026 06:07 CST
bobdxb
Hi Nicholas,
We have done checks on SG server and result came back as no threat present. WP 7.1.4 is latest version.
Akeeba PHP Scanner - 6,000 threat points
File location - Official WordPress core
PuTTY verification - Reported no threat
Likely conclusion - False positive
I hope you can confirm also as false positive, and I will mark it as such in scan report or you suggest something in addition. Thank you for help, kind regards
Tuesday, 03 November 2026 08:06 CST
nicholas
Akeeba Staff
Manager
Please do read the page I linked as it answers your question. It tells you go to confirm a file is legitimate and how to mark it safe so it's not reported again. This is the same thing as Joomla, really.
In the next version of Admin Tools for WordPress the core files like this will be checked against core file signatures we collect from official releases, allowing it to skip over false positives in core WordPress files without bothering you. Until then, manual intervention for false positives in core WordPress files is necessary.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!