By default, MalCare scans only WordPress files. Skipped files are non-WordPress files. However, MalCare allows you to add non-WordPress files and then run a scan.