Security Scanner Conflicts

Why scanners flag GOCSM files #

Wordfence, Sucuri, iThemes Security (Solid Security), and All-In-One Security (AIOS) monitor wp-content/uploads/ for PHP files, because PHP files in the uploads directory are a common sign of a compromised site. GOCSM’s generated snippet files are PHP files in that directory, so they may be flagged or even quarantined.

This is a false positive. The files are intentionally placed there by GOCSM, they contain if (!defined('ABSPATH')) { exit; } guards, and direct HTTP access is blocked by .htaccess (Apache) or Nginx rules.

The fix is to add GOCSM’s directory to your scanner’s exclusion list.

Wordfence #

1. In WordPress admin, go to Wordfence > Firewall > Blocking.
2. Scroll to Allowlisted URLs or go to Wordfence > All Options > General Wordfence Options.
3. Under Excluded Paths, add: wp-content/uploads/gocsm/snippets/
4. Save.

Alternatively, go to Wordfence > Scan > Scan Options and add the path to the exclusion list there.

Sucuri Security #

1. Go to Sucuri Security > Settings > Ignored Files and Folders.
2. Add: wp-content/uploads/gocsm/snippets
3. Save changes.

iThemes Security (Solid Security) #

1. Go to Security > Settings > File Change Detection.
2. Under Excluded Directories, add uploads/gocsm/snippets.
3. Save.

All-In-One Security (AIOS) #

1. Go to WP Security > Scanner > File System Security.
2. Add wp-content/uploads/gocsm/snippets to the exclusion list.
3. Save.

Why files are in uploads/ #

WordPress guarantees wp-content/uploads/ is writable. The plugin directory and wp-content/ root are not guaranteed writable on all hosts. GOCSM uses uploads as the standard WordPress-conventional writable location, consistent with how WooCommerce, EDD, and other plugins store generated files.