diff --git a/lib/CleantalkSP/SpbctWP/Scanner/Helper.php b/lib/CleantalkSP/SpbctWP/Scanner/Helper.php
index f602417ee..b45b8cbcb 100644
--- a/lib/CleantalkSP/SpbctWP/Scanner/Helper.php
+++ b/lib/CleantalkSP/SpbctWP/Scanner/Helper.php
@@ -434,7 +434,7 @@ public static function getSQLWhereAddictionForTableOfCategory($category)
             case 'unknown':
                 $res = ' WHERE status NOT IN ("APPROVED_BY_USER","APPROVED_BY_CT","APPROVED_BY_CLOUD","DENIED_BY_CT","ERROR") AND
 						    detected_at >= ' . (time() - $spbc->settings['scanner__list_unknown__older_than'] * 86400) . ' AND
-						    source IS NULL AND
+						    (source IS NULL OR source = \'\') AND
 						    source_type IS NULL AND
 						    size > 0 AND
 		                    path NOT LIKE "%wp-content%themes%" AND
diff --git a/lib/CleantalkSP/SpbctWP/Scanner/ScannerQueue.php b/lib/CleantalkSP/SpbctWP/Scanner/ScannerQueue.php
index 0b50fcf9e..e9784b878 100644
--- a/lib/CleantalkSP/SpbctWP/Scanner/ScannerQueue.php
+++ b/lib/CleantalkSP/SpbctWP/Scanner/ScannerQueue.php
@@ -1049,13 +1049,25 @@ public function file_system_analysis($offset = null, $amount = null, $path_to_sc
                     $file['checked_heuristic'] = 0;
                 }
 
-                // if extension is not set, set 'source' to 'binary'
-                $file['source'] = ! $ext ? 'BINARY' : '';
+                // No extension → BINARY. With extension → NULL (preferred; Unknown also accepts legacy '').
+                $source_sql = $ext === '' ? "'BINARY'" : 'NULL';
+
+                $sql_row = '(\''
+                    . $file['path'] . '\',\''
+                    . $file['size'] . '\',\''
+                    . $file['perms'] . '\',\''
+                    . $file['mtime'] . '\',\''
+                    . $file['fast_hash'] . '\',\''
+                    . $file['full_hash'] . '\',\''
+                    . $file['detected_at'] . '\',\''
+                    . $file['checked_heuristic'] . '\','
+                    . $source_sql
+                    . ')';
 
                 if ( ! spbc_check_ascii($file['path']) ) {
-                    $sql_query__values_non_ascii[] = '(\'' . implode('\',\'', $file) . '\')';
+                    $sql_query__values_non_ascii[] = $sql_row;
                 } else {
-                    $sql_query__values[] = '(\'' . implode('\',\'', $file) . '\')';
+                    $sql_query__values[] = $sql_row;
                 }
             }
 
@@ -1063,7 +1075,7 @@ public function file_system_analysis($offset = null, $amount = null, $path_to_sc
 			
 			size        = VALUES(`size`),
 			perms       = VALUES(`perms`),
-			source      = source,
+			source      = IF(source IS NULL OR source = '', VALUES(`source`), source),
 			source_type = source_type,
 			version     = version,
 
diff --git a/lib/CleantalkSP/SpbctWP/Scanner/Stages/Repositories/UnknownRepository.php b/lib/CleantalkSP/SpbctWP/Scanner/Stages/Repositories/UnknownRepository.php
index f52d2b6d2..38a4b078a 100644
--- a/lib/CleantalkSP/SpbctWP/Scanner/Stages/Repositories/UnknownRepository.php
+++ b/lib/CleantalkSP/SpbctWP/Scanner/Stages/Repositories/UnknownRepository.php
@@ -36,7 +36,7 @@ protected function catchResultData()
         return $this->db->fetchAll(
             'SELECT full_hash, mtime, size, path, source, severity, detected_at'
             . ' FROM ' . SPBC_TBL_SCAN_FILES
-            . ' WHERE source IS NULL AND'
+            . ' WHERE (source IS NULL OR source = \'\') AND'
             . ' status <> "APPROVED_BY_USER" AND'
             . ' status <> "APPROVED_BY_CT" AND'
             . ' status <> "APPROVED_BY_CLOUD" AND'