Title: Flag by Wordfence Security Plugin
Last modified: July 29, 2026

---

# Flag by Wordfence Security Plugin

 *  Resolved [Web Whales](https://wordpress.org/support/users/webwhales/)
 * (@webwhales)
 * [1 week, 4 days ago](https://wordpress.org/support/topic/flag-by-wordfence-security-plugin/)
 * Dear Support,
 * I’ve noticed that a report came in from Wordfence about possible malicious code
   within the Robin plugin. It was about the following notice:
 *     ```wp-block-code
       Suspicious ROT13-encoded filter associated with rogue WP plugins
       ```
   
 * This is located within the file: `/wp-content/plugins/plugins/robin-image-optimizer/
   includes/classes/class-rio-media-library.php`.
 * Specifically it is about the following piece of code:
 *     ```wp-block-code
       add_filter(str_rot13('jope/evb/nyybj_freiref'), 'WIO_Backup::alternateStorage');
       ```
   
 * Wordfence is in my opinion rightfully flagging this since functions like: `str_rot13`
   could be used by hackers to mask certain strings in the code.
 * **My primary question is**, why is this needed? Why can’t we just have the value
   here that `str_rot13` is referring to? Which is `wbcr/rio/allow_servers`.
 * I hope to hear from you guys regarding why this has been done and if there is
   any incentive from you guys to change this mechanism.
 * Kind regards,
    -  This topic was modified 1 week, 4 days ago by [Web Whales](https://wordpress.org/support/users/webwhales/).

Viewing 1 replies (of 1 total)

 *  Plugin Support [Kush](https://wordpress.org/support/users/kushnamdev/)
 * (@kushnamdev)
 * [1 week, 3 days ago](https://wordpress.org/support/topic/flag-by-wordfence-security-plugin/#post-18978973)
 * Hi [@webwhales](https://wordpress.org/support/users/webwhales/),
 * Thanks for the detailed report and for taking the time to decode the string before
   reaching out.
 * You’re correct that Wordfence flagged the pattern, but we can confirm this is
   a false positive. The code is part of the official plugin release from WordPress.
   org, and your site has not been compromised.
 * The `str_rot13()` call is an old leftover from a previous implementation The 
   logic it belonged to was removed some releases ago; this one registration was
   missed and has been carried along since. It registers the `wbcr/rio/allow_servers`
   filter, but the callback it points to no longer performs any logic, so it has
   no effect on the plugin’s behavior.
 * We agree that this kind of code can look suspicious, so we’ve already removed
   it. The change will be included in an upcoming release. This will not affect 
   functionality.
 * We also reviewed the rest of the plugin and confirmed this is the only use of`
   str_rot13()`. There is no use of `eval`, `base64_decode`, `gzinflate`, `create_function`,
   or any other form of dynamic code execution in the plugin.
 * For now, it’s safe to exclude this file from Wordfence scans. Once you update
   to the upcoming version, you can remove the exclusion.
 * Thanks again for reporting this.

Viewing 1 replies (of 1 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fflag-by-wordfence-security-plugin%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/robin-image-optimizer/assets/icon-256x256.gif?rev=3523840)
 * [Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF](https://wordpress.org/plugins/robin-image-optimizer/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/robin-image-optimizer/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/robin-image-optimizer/)
 * [Active Topics](https://wordpress.org/support/plugin/robin-image-optimizer/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/robin-image-optimizer/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/robin-image-optimizer/reviews/)

## Tags

 * [malicious](https://wordpress.org/support/topic-tag/malicious/)
 * [masking](https://wordpress.org/support/topic-tag/masking/)
 * [security-scan](https://wordpress.org/support/topic-tag/security-scan/)

 * 1 reply
 * 2 participants
 * Last reply from: [Kush](https://wordpress.org/support/users/kushnamdev/)
 * Last activity: [1 week, 3 days ago](https://wordpress.org/support/topic/flag-by-wordfence-security-plugin/#post-18978973)
 * Status: resolved