Understanding findings

Every finding Stalza Security raises is designed to be actionable — not just a raw alert.

Risk vs confidence

• Risk answers "how bad if this is real?" — for example, a modified wp-config.php is high risk even before malware rules run.
• Confidence answers "how sure are we?" — a core file that fails its official checksum and matches a malware signature is high confidence; a single weak pattern in a theme template is low.

Triage high risk + high confidence first. Low confidence findings are usually review-or-ignore, not emergency restores.

Where findings appear

• Dashboard — open items that still need attention.
• Scan / module tabs — findings from the last run of that suite.
• Events — chronological audit trail (scans started, lockouts, setting changes, findings opened/closed).

Recommended actions

Action	When to use it
Restore	Trusted checksum failed (core / WordPress.org plugin). Replace from a clean source.
Review	Suspicious but not definitive. Open the file path, compare to a backup, ask your developer.
Accept / baseline	Intentional change (theme edit, known custom plugin). Future scans stop re-flagging it.
Ignore	Confirmed false positive you do not want to see again for this signal.
Unlock / allowlist	Login Protection blocked a legitimate IP or user.

Closing the loop

Mark findings resolved when you have restored or accepted them. Resolved items stay in Events for history but leave the Dashboard queue.