To scan your core WordPress files, go to Security Ninja → Core Scanner and click Scan Core Files.
A progress overlay runs while the plugin fetches the official file list from wordpress.org for your WordPress version and locale, then compares checksums locally. Most scans finish in under a minute.
Reading results
The summary strip shows scan context, status, and last-run metadata. Findings appear in a table grouped by type (modified, missing, unknown) with severity, guidance, and actions.
You can View File, open a diff for modified core files, Restore, Delete, or mark files to ignore without leaving the page.
Large or binary-safe previews open in the File Viewer.
What gets scanned
Security Ninja checks standard core paths, including:
- Files under
wp-adminandwp-includes - Expected and unexpected files in the WordPress root
- Hidden dotfiles in core directories
There are well over a thousand core files in a typical install. Each one is verified against the official manifest.
My developer modified core files
That is not always malicious. Some hosts or legacy setups still touch core files. Unless you know why a file changed, treat unexpected modifications as a risk and review them in the File Viewer before restoring or deleting.
Note: If you re-install WordPress, manual core edits are overwritten. Confirm with your developer before restoring from the scanner.
Keep WordPress updated. Core updates include security fixes that plugins and themes may depend on.
