Yes, this produces a lot of false positives, but once you learn how to recognize a real hack, this plugin is gold. Finds files Wordfence and others miss. So use the other “automatic” security plugins first, then run this after to find what they didn’t. Combine them and you’ll be well protected.