A clean scan from a free WordPress security plugin only means it didn’t recognize the threat. Here’s a real case: a disguised plugin ran a live backdoor for weeks while Wordfence scanned it on schedule and never caught it.