Thanks for trying the plugin. A scan returning no detection on a site believed to be compromised does not, by itself, identify a detection failure.
“Hacked” is not a specific technical diagnosis. A compromise may involve stolen credentials, malicious database content, server-level changes, code outside the configured scan scope, or an infection that was no longer present when the scan ran. Some managed hosts also place WordPress core files behind symlinks or outside the site’s normal filesystem root, which can affect what an application-level scanner is permitted or configured to inspect.
To investigate a missed detection, we need a confirmed malicious file, code fragment, database entry, or other indicator of compromise that was present during the scan, together with its actual filesystem location, the hosting environment, plugin and signature versions, and scan configuration.
None of that information is included here, so there is no identified sample against which the scan result can be reproduced or diagnosed. Please open a support topic with those details—without publishing malicious code or sensitive site information—and we will investigate it.
A scan reporting no detection is an observation. Establishing a missed detection requires identifying what was present, where it was located, and why it fell within the scanner’s stated scope.
