Skip to main content

Hosting Provider Flagging AllAccessible as Malware (False Positive)

Some web hosting providers (particularly SiteGround, GoDaddy, and Bluehost) use automated malware scanners that may incorrectly flag the AllAccessible

Written by Frank

Hosting Provider Flagging AllAccessible as Malware (False Positive)

Overview

Some web hosting providers (particularly SiteGround, GoDaddy, and Bluehost) use automated malware scanners that may incorrectly flag the AllAccessible plugin or widget code as malicious. This is a false positive - our code is safe, verified, and does not contain any malware. This guide explains why it happens and how to resolve it.

Who This Is For

  • Website owners who received a malware warning after installing AllAccessible

  • Web designers or developers installing AllAccessible on client sites

  • Anyone whose hosting provider flagged AllAccessible files

What You'll Learn

  • Why hosting providers flag AllAccessible as malware

  • How to resolve the issue with your hosting provider

  • How to whitelist AllAccessible in your hosting security settings

  • How to prevent future false positives

Why This Happens

How Automated Malware Scanners Work

Web hosting companies use automated, pattern-based scanning tools to protect their servers. These scanners look for code patterns that are commonly found in actual malware, such as:

  • Loading external JavaScript files - Malware often injects remote scripts to steal data or redirect visitors

  • Dynamically constructed URLs - Malware frequently builds URLs on the fly to evade detection

  • Minified or compressed code - Attackers compress their code to make it harder to read

The problem: These same patterns are also used by every legitimate SaaS plugin, including Google Analytics, HubSpot, Intercom, Crisp, and AllAccessible. The scanner cannot tell the difference between a malicious script injection and a legitimate accessibility widget.

What AllAccessible Actually Does

Our plugin loads a small JavaScript file from our secure servers (api.allaccessible.org) that powers your accessibility widget. This is the standard way all cloud-based plugins work - it ensures you always have the latest features and security updates without needing to manually update.

Our plugin is:

  • Listed and verified on the official WordPress.org Plugin Directory

  • Reviewed by the WordPress Plugin Review Team for security and coding standards

  • Served over HTTPS with encrypted connections

  • Regularly audited for security vulnerabilities

How to Resolve This

Step 1: Don't Panic

Your website has not been hacked. The hosting provider's automated scanner made a mistake. Your site and your visitors' data are safe.

Important: Some hosting providers give you a deadline (e.g., 3 days) to "clean" the files before suspending your site. Follow the steps below promptly to avoid any disruption.

Step 2: Contact Your Hosting Provider

Reach out to your hosting provider's support team and let them know this is a false positive. You can use or adapt the message below:

Subject: False Positive Malware Detection - AllAccessible WordPress Plugin

Hello,

Your security scanner has flagged files from the AllAccessible WordPress plugin as malicious. This is a false positive.

AllAccessible is a verified, legitimate accessibility plugin listed on the official WordPress.org Plugin Directory:
​https://wordpress.org/plugins/allaccessible/

The plugin loads an external JavaScript file from our secure API server (api.allaccessible.org) to power an accessibility widget for website visitors. This is standard practice for cloud-based SaaS plugins and is not malicious activity.

Could you please:

  1. Review the flagged files and confirm this is a false positive

  2. Whitelist the AllAccessible plugin files

  3. Restore file permissions if they were changed

If you need verification from the plugin developer, they can be reached at [email protected].

Thank you.

Step 3: Whitelist AllAccessible (If Available)

Some hosting providers allow you to whitelist specific files or directories. If your host offers this option:

  1. Log in to your hosting control panel (cPanel, SiteGround Site Tools, etc.)

  2. Navigate to the security or malware scanner section

  3. Find the flagged files (usually under a "Security Report" or "Important Notifications" section)

  4. Mark the AllAccessible files as false positive or trusted

Step 4: Restore File Permissions

If your hosting provider changed file permissions (making files non-executable), you may need to restore them:

For SiteGround:

  1. Log in to SiteGround Site Tools

  2. Go to Security > Site Scanner or check Important Notifications

  3. View the security report

  4. Mark files as false positive to restore permissions

For cPanel-based hosts:

  1. Log in to cPanel

  2. Open File Manager

  3. Navigate to wp-content/plugins/allaccessible/

  4. Right-click on flagged files > Change Permissions

  5. Set PHP files to 644 and directories to 755

Via FTP:

  1. Connect to your site via FTP (FileZilla, Cyberduck, etc.)

  2. Navigate to wp-content/plugins/allaccessible/

  3. Set file permissions to 644 for files and 755 for directories

Step 5: Verify the Plugin is Working

After resolving with your hosting provider:

  1. Visit your website's front-end (not the admin area)

  2. Check that the accessibility widget button appears (usually bottom-right corner)

  3. Click the widget to verify it opens and functions correctly

  4. Log in to your AllAccessible dashboard to confirm data is flowing

Hosting Provider-Specific Instructions

SiteGround

SiteGround is known for particularly aggressive automated scanning. Their system automatically changes file permissions and sends warning emails.

  1. Log in to SiteGround Site Tools (or Client Area)

  2. Check Home > Important Notifications for the security report

  3. Review the flagged files - they will be AllAccessible plugin files

  4. Contact SiteGround support via chat and reference the security report

  5. Ask them to whitelist the AllAccessible plugin directory

  6. Request file permissions be restored

SiteGround Support Chat: Available 24/7 in your Site Tools dashboard

GoDaddy

  1. Log in to your GoDaddy hosting dashboard

  2. Check Security section for any malware alerts

  3. If using GoDaddy's Website Security (Sucuri), log into the Sucuri dashboard

  4. Review the scan results and mark AllAccessible files as safe

  5. Contact GoDaddy support if you need help clearing the alert

Bluehost

  1. Log in to your Bluehost dashboard

  2. Navigate to Security > SiteLock (if enabled)

  3. Review flagged files

  4. Mark as false positive or contact Bluehost support

Other Hosting Providers

For any hosting provider:

  1. Find their security or malware scanning section in your control panel

  2. Review the flagged files (they will be in wp-content/plugins/allaccessible/)

  3. Mark as false positive or trusted

  4. Contact their support team with the template message above if needed

If Your Site Was Suspended

If your hosting provider suspended your site before you could resolve the issue:

  1. Contact hosting support immediately - Explain this is a false positive

  2. Provide proof - Share the WordPress.org plugin listing URL: https://wordpress.org/plugins/allaccessible/

  3. Request restoration - Ask them to unsuspend your site and whitelist the plugin

  4. Escalate if needed - If front-line support can't help, ask to escalate to their security team

Preventing Future False Positives

  1. Whitelist the plugin directory - If your host allows it, add wp-content/plugins/allaccessible/ to their scanner's whitelist

  2. Notify your host before installing - If your host has aggressive scanning, let them know you're installing a verified WordPress.org plugin beforehand

  3. Keep the plugin updated - Always use the latest version from WordPress.org

  4. Document the false positive - If your host resolved it once, reference that ticket number for any future occurrences

Non-WordPress Installations

If you're using AllAccessible via the JavaScript code snippet (not the WordPress plugin) and your host flagged it:

The code snippet simply adds a <script> tag that loads our widget from api.allaccessible.org. This is identical to how Google Analytics, Facebook Pixel, and hundreds of other legitimate services work.

To resolve:

  1. Contact your hosting provider

  2. Explain the <script> tag is loading a legitimate accessibility service

  3. Provide our website URL: https://www.allaccessible.org

  4. Ask them to whitelist requests to api.allaccessible.org

Frequently Asked Questions

Q: Is AllAccessible actually safe to install?
A: Yes. AllAccessible is a verified plugin on WordPress.org, which requires passing a security review by the WordPress Plugin Review Team. Our code is open source and can be inspected by anyone.

Q: Why does my hosting provider think it's malware?
A: Automated scanners use pattern matching to detect threats. Our plugin loads external JavaScript (our accessibility widget) from our API servers, which matches patterns that malware also uses. The scanner cannot distinguish between legitimate and malicious use of this pattern.

Q: Will this happen every time I update the plugin?
A: It depends on your hosting provider. Some hosts remember whitelisted files, while others may re-scan after updates. If it happens again after an update, reference your previous support ticket with your host.

Q: Can I install AllAccessible without loading external JavaScript?
A: No. AllAccessible is a cloud-based service that requires loading our widget script from our servers. This is what allows us to provide real-time updates, analytics, and premium features without requiring manual plugin updates.

Q: What if my hosting provider won't whitelist the plugin?
A: This is rare, but if it happens, contact us at [email protected]. We can provide additional documentation or communicate directly with your hosting provider's security team.

Q: Does this affect other accessibility plugins too?
A: Yes. Any SaaS-based plugin that loads external resources can trigger these scanners. This is a known limitation of automated malware detection.

Related Articles

Need Help?

If you're still having trouble after following these steps:

Email Support:

  • Send details to: [email protected]

  • Include: your hosting provider name, the security report or warning email, and your website URL

  • Response time: 24-48 hours

WordPress Support Forum:

Last Updated: March 2026
​Article Category: Troubleshooting
​Related Systems: WordPress Plugin, JavaScript Widget, Hosting Providers

Did this answer your question?