Hi @mpedersen, that was helpful thank-you.
I’m not entirely sure at this stage why you can’t see the results, but I suspect a possible theme/plugin conflict so it could be worth disabling all plugins except for Wordfence and reverting to a default theme (I recommend Twenty Twenty-Four due to the results I’ll show you below) to see if they show up:
[File]
Unknown file in WordPress core: wp-includes/load.php.orig
Issue Found: March 18, 2026 5:31 am
Severity: High
Filename: /home/d*******u/l****************************m/wp-includes/load.php.orig
Details: This file is in a WordPress core location but is not distributed with this version of WordPress. This scan often includes files left over from a previous WordPress version, but it may also find files added by another plugin, files added by your host, or malicious files added by an attacker.
[File]
Unknown file in WordPress core: wp-includes/functions.php.orig
Issue Found: March 18, 2026 5:31 am
Severity: High
Filename: /home/d*******u/l****************************m/wp-includes/functions.php.orig
Details: This file is in a WordPress core location but is not distributed with this version of WordPress. This scan often includes files left over from a previous WordPress version, but it may also find files added by another plugin, files added by your host, or malicious files added by an attacker.
[File]
Unknown file in WordPress core: wp-admin/includes/upgrade.php.orig
Issue Found: March 18, 2026 5:31 am
Severity: High
Filename: /home/d*******u/l****************************m/wp-admin/includes/upgrade.php.orig
Details: This file is in a WordPress core location but is not distributed with this version of WordPress. This scan often includes files left over from a previous WordPress version, but it may also find files added by another plugin, files added by your host, or malicious files added by an attacker.
[File]
Modified theme file: wp-content/themes/arjuna-x/images/header/darkBlue.jpg
Issue Found: March 18, 2026 5:32 am
Severity: Medium
Filename: /home/d*******u/l****************************m/wp-content/themes/arjuna-x/images/header/darkBlue.jpg
Details: This file belongs to theme "Arjuna X" version "1.7.1" and has been modified from the original distribution. It is common for site owners to modify their theme files, so if you have modified this file yourself you can safely ignore this warning.
[File]
Modified theme file: wp-content/themes/twentytwentyfive/style.min.css
Issue Found: March 18, 2026 5:32 am
Severity: Medium
Filename: /home/d*******u/l****************************m/wp-content/themes/twentytwentyfive/style.min.css
Details: This file belongs to theme "Twenty Twenty-Five" version "1.4" and has been modified from the original distribution. It is common for site owners to modify their theme files, so if you have modified this file yourself you can safely ignore this warning.
[File]
Modified theme file: wp-content/themes/twentytwentythree/style.css
Issue Found: March 18, 2026 5:32 am
Severity: Medium
Filename: /home/d*******u/l****************************m/wp-content/themes/twentytwentythree/style.css
Details: This file belongs to theme "Twenty Twenty-Three" version "1.6" and has been modified from the original distribution. It is common for site owners to modify their theme files, so if you have modified this file yourself you can safely ignore this warning.
I do suspect these to be benign at this stage, but it’s not good practice to see WordPress core, plugin, or theme files edited or added directly to their install folders.
*.orig files are normally caused by Plesk during an install/update from our experience, so those 3 are safe to remove manually using FTP or your host’s file manager as WordPress doesn’t use them.
You can uninstall Twenty Twenty-Three and Twenty Twenty-Five that have CSS updates to solve those problems if you don’t normally use them. Manually remove the modified files if they’re left behind in the folders shown above afterwards. You can always reinstall the themes after if you want them. Take backups if you modified those files yourself and think you might need them.
The Arjuna X darkBlue.jpg may be an update you have made to change its appearance. It can be moved to your uploads folder and used from there if the theme has an in-line editor or you can normally choose to ignore this result in Wordfence if it’s something you don’t want to remove/change, but I appreciate we’ll need to get the scan results showing in order to do that.
If you can’t get the results to show up when Wordfence is the only plugin on an unmodified default theme, please can you send us a screenshot of your scan page so we can try to work out what might be happening there?
Many thanks,
Peter.
