What is a WordPress core file integrity check?

WordPress core, the files that ship with a given version, is identical on every site that runs it. That sameness makes an integrity check possible. If your copy of wp-login.php does not match the official one byte for byte, something changed it, and nothing legitimate should ever need to.

How it works

WordPress.org publishes a checksum, a short cryptographic fingerprint, for every core file in every released version. A core integrity check downloads that list and compares it with the files on your server. A match means the file is unchanged since it left WordPress.org. A mismatch means it was modified, added or deleted after installation, which core files should never be.

The check does not need to understand what a change does. It only needs to know the file is not what it should be. That is a simpler question than "is this code malicious?", and it has a clear answer.

Why it catches what other checks miss

A signature-based malware scanner looks for known malicious patterns. It can miss custom or well-obfuscated code it has never seen. Attackers know this, and a common move is to add a few lines to a core file such as index.php or one in wp-includes, where the change blends in. A checksum comparison flags that edit regardless of how the code is disguised, so it is effective against new or hand-written backdoors that match no signature yet.

It is a complement to malware scanning, not a replacement. Checksums cannot see a malicious plugin or a spam post in the database, so a full scan combines both.

How to run one yourself

With SSH and WP-CLI, go to your WordPress folder and run:

wp core verify-checksums

A clean site prints a success message. Otherwise each problem is listed with a reason, such as a file that does not verify against its checksum, or a file that should not exist. A few notes:

• It checks the core folders and root files. It does not check wp-content, where your themes, plugins and uploads live, and it ignores wp-config.php.
• If your site uses a non-English locale, add --locale=fr_FR (for example), so it compares against the right release.
• For plugins from the WordPress.org directory, wp plugin verify-checksums --all does the same job. Premium and custom plugins have no public checksums.

Without WP-CLI, download the exact same WordPress version from wordpress.org, unzip it, and compare its wp-admin and wp-includes folders with your site's using any comparison tool or diff -r.

What a mismatch actually means

Treat any difference inside wp-admin or wp-includes as worth investigating at once. Nothing there should ever be edited by hand, so a change usually means a compromised file, and occasionally a corrupted update. The cases look like this:

• "File doesn't verify against checksum" means a core file was altered. Compare it with a clean copy to see exactly what was added.
• "File should not exist" means an extra file sits among core files. Open it. Unknown PHP files in core folders are a strong sign of a backdoor.
• Harmless extras also happen. A host may add an error_log file, and some owners delete readme.html or license.txt on purpose. Those can be ignored once you know why they are there.

If a real core file was modified, do not just fix that one file. Someone had write access, so find out how, as described in how to fix a hacked WordPress site.

Restoring clean core files

Back up first. Then, from the WordPress folder, wp core download --force --skip-content replaces core files with clean copies of your installed version and leaves wp-content and wp-config.php alone. Run the check again afterwards to confirm it passes. Replacing core files does not remove a backdoor hiding in a plugin, a theme or the database, so follow up with a full scan.