False postoves

This is most likely not a false positive. 99% of the time, only hackers use hex encoded function names. I would take the site down for maintenance and begin clearing out hacked files. If you didn’t put that file there, I would say there is a high likelihood that your site has been compromised.

Are you comfortable with providing a pastebin.com link to the contents of the wp-content/wflogs/index.php file? I’d like to see what all is in it.

All of a sudden the file index.php placed in wp-content/wflogs folder no longer exists.

Hello, @drmrgood.

I would not expect to see that file or contents in the wflogs folder. As a last resort, you can delete the wflogs folder itself (I would make a local backup of it) and the folder will regenerate the contents, however, keep in mind you will lose some block data and the protection will go into Learning Mode. I would then recommend you switch from Learning Mode to Enabled and Protecting via Wordfence > Firewall > All Firewall Options > Web Application Firewall Status.

I would recommend running a high sensitivity scan (Wordfence > Scan > Scan Options and Scheduling) to see if anything else suspicious is found, then if need be, consider having a site cleaning or audit done to further check for malware.

Please let me know if you have any questions.

Scott