A flag with no obvious malware usually means either a false positive, or malicious code that only activates under specific conditions (e.g. only shown to search engine crawlers, or only on certain pages/times) to evade casual inspection.
Where to look
- Compare your site’s source as rendered to a search engine crawler (cloaked malware often only injects content for crawler user-agents)
- Check recently modified files by timestamp, even ones that look like legitimate core files
- Review scheduled tasks/cron jobs for anything unfamiliar
- Check for new, unrecognized admin/user accounts
If truly nothing is found
Request a review anyway with a clear explanation, since false positives do happen — but also scan for vulnerable (not yet exploited) plugins/software, since being flagged sometimes precedes visible exploitation by hours or days.
FAQ
Could this be a false positive?
Yes, it happens, but treat it as a prompt to actively rule out cloaked malware before assuming so — the review process itself will confirm either way.