Changed files not detected

Is there a known trick that render wordpress’ sucuri or wordfence file integrity scan useless?

I have a WP installation with changed index.php (among others) and both Sucuri & Wordfence said there’s nothing to worry about.

Thank you.