---
title: Core file integrity
canonical: https://wpsecurityninja.com/dictionary/core-file-integrity/
---
# Core file integrity

Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.

Last updated: 2026-08-26

Also called: WordPress core integrity, core integrity, tampered core files

## Related terms

- [File integrity monitoring](https://wpsecurityninja.com/dictionary/file-integrity-monitoring/): File integrity monitoring checks whether important files changed compared with a known-good baseline.
- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [wp-config.php](https://wpsecurityninja.com/dictionary/wp-config/): wp-config.php holds database credentials, keys, and core WordPress settings for the site.

[Full guide](https://wpsecurityninja.com/wordpress-core-files-were-modified/)

## Why it matters for WordPress

Attackers sometimes patch a core file so their backdoor loads on every request. The site can look fine in wp-admin while `wp-includes` is no longer stock WordPress. Comparing core to official hashes catches that class of persistence even when malware signatures miss it.

## How it shows up in practice

- Scanner reports that specific core files differ from expected checksums
- Odd behavior after a “cleanup” that never reinstalled core
- Manual edits someone made “just to fix a warning” inside core (also a problem)
- Reinfection until the modified dropper file is replaced

## What to do

1. Scan core after incidents and on a regular schedule.
2. Investigate diffs; do not dismiss them because the homepage looks fine.
3. Reinstall core from trusted packages when tampering is confirmed (and avoid editing core going forward).
4. Pair with malware scanning and an events log for a full picture.

## In WP Security Ninja

The [Core scanner](https://wpsecurityninja.com/core-scanner/) checks WordPress core files against known-good copies so unexpected edits stand out. If the warning is “core files were modified,” start with [what that means](https://wpsecurityninja.com/wordpress-core-files-were-modified/). Use it with the [malware scanner](https://wpsecurityninja.com/malware-scanner/) when you suspect quiet tampering rather than only spam redirects.