WordPress core file integrity check

What it does

Malware that buries itself in WordPress core files is invisible to a casual look. The wp-includes directory contains thousands of files nobody reads. This check compares every core file on disk against the official checksums WordPress.org publishes for your exact version and locale.

The result is a clean, itemized verdict: files that were modified, files that are missing, and unknown files that should not be there at all, each with size and modification time.

How it works

Run it from the dashboard whenever you want a verdict: after an update, after restoring a backup, or any time something feels off. Results are cached briefly so repeat checks are instant, and a force-refresh re-reads everything from disk.

The check covers WordPress core: the root files, wp-admin and wp-includes. Plugins and themes are intentionally out of scope here: known vulnerabilities in them are the vulnerability scanner's job, and change detection across plugins, themes and mu-plugins is what Pro's continuous file monitoring does.

• Official WordPress.org checksums for your version and locale
• Modified / missing / unknown verdicts with file details
• On-demand from the dashboard, with force refresh
• No third-party service: WordPress.org is the only call