The fix, in one snippet
file suspicious.pdf
# 'PE32 executable' means it is a program, not a PDFIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner reads the file's leading bytes and compares them against known signatures: MZ for Windows executables, %PDF-, PK\x03\x04 for zip-based formats (plain zip, Office OOXML, JAR, APK), \x7fELF, D0 CF 11 E0 for legacy OLE Office files, Rar!, 7z\xBC\xAF, the 4C 00 00 00 shortcut header, HTML markers, and image headers (\x89PNG, JFIF, GIF89a). For zip containers it opens the listing and uses [Content_Types].xml to tell a .docx from a plain .zip. The result is compared with the extension. Content that is executable, script or archive behind a document or image extension is high severity; a benign mismatch such as a PNG saved as .jpg is reported at low severity.
Limits: plain text, CSV and scripts have no magic bytes, so their extensions cannot be verified this way; those files are covered by the script checks instead.
Why it matters
Operating systems, mail filters and people all decide what a file is from its name and icon, while the program that opens it decides from the bytes. Attackers exploit the gap: an RTF exploit document named .doc (the CVE-2017-11882 campaigns), a zip named .png to pass an image-only upload filter, an HTML smuggling page named .jpg, or polyglot files that are valid as two formats at once (PDF and zip, GIF and JAR). A mismatch of this kind is a signature of evasion, because the delivery mechanism will restore the real type later, usually by a script that renames it.
How to fix it
Do not rename the file to "make it work". Confirm the real type yourself with the file command on macOS or Linux, or a hex viewer on Windows:
$ file invoice.pdf
invoice.pdf: PE32 executable (GUI) Intel 80386, for MS WindowsIf the real type is harmless and the mismatch is an accident (a website served a PNG with a .jpg name), the file is fine. If an executable, archive or script is hiding behind a document extension, delete it and report it. Related checks: double extensions and embedded executables. Guides: disguised files and is this file safe?
Where this fits
File content does not match its extension is check 7 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Executable embedded inside another file (high), where an executable program is embedded inside a file of another type, such as a Windows binary hidden in a PDF, an Office document, an RTF or an image. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
File content does not match its extension closes one route in. Immediately below it: HTML file assembles a download in the browser, where the HTML file assembles a download inside the browser from encoded data using JavaScript, delivering a payload that never crossed the network as a file; Obfuscated or encoded script, where the script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide what it does; Office document contains macros, where the Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: File content does not match its extension (high severity)
Scanner check id: extension-mismatchThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents
invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide