Unfortunately
add_filter( ‘ss_excluded_by_default’, function ( $excludes ) { unset( $excludes[‘.php’] ); return $excludes;} );
has no effect for me. There are still no .php files in plugins directory.
The files are index.php which are build into website as iframes.
If a .php shouldn’t be accessible, there is 500 Error in 3.1.9, therefore for me makes this change no sense.