Core file integrity

Why it matters for WordPress

Attackers sometimes patch a core file so their backdoor loads on every request. The site can look fine in wp-admin while wp-includes is no longer stock WordPress. Comparing core to official hashes catches that class of persistence even when malware signatures miss it.

How it shows up in practice

• Scanner reports that specific core files differ from expected checksums
• Odd behavior after a “cleanup” that never reinstalled core
• Manual edits someone made “just to fix a warning” inside core (also a problem)
• Reinfection until the modified dropper file is replaced

What to do

1. Scan core after incidents and on a regular schedule.
2. Investigate diffs; do not dismiss them because the homepage looks fine.
3. Reinstall core from trusted packages when tampering is confirmed (and avoid editing core going forward).
4. Pair with malware scanning and an events log for a full picture.

In WP Security Ninja

The Core scanner checks WordPress core files against known-good copies so unexpected edits stand out. Use it with the malware scanner when you suspect quiet tampering rather than only spam redirects.