WordPress core file integrity checks
Malware likes to hide in WordPress core files, where people rarely look. Compare them with the official release and you find it.
One line in wp-includes is enough to leave a backdoor.
Whoever breaks into a WordPress site often edits a core file so they can come back. Popular security plugins look elsewhere, and an update doesn't always overwrite the file.
Nobody checks thousands of files by hand. With the official checksums the comparison takes a few seconds.
Every file compared with the official release.
Official checksums
We use the checksums WordPress.org publishes for the version and language of the installed package.
Comparison on the site
The agent hashes every core file and flags the ones that were changed and the ones that shouldn't be there.
Changed lines
For each flagged file you see the lines that differ from the official package, with functions typical of backdoors highlighted.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Where do the checksums come from?
From the official WordPress.org API, for the version and language of the package the site was installed from.
I changed a core file on purpose. What happens?
You approve the change and the file is no longer flagged, until it changes again.
Does the check slow the site down?
No. The agent works in steps of a few seconds, built for shared hosting.
Goes well with
- PHP malware in the uploads folder: how to find it quicklyPHP in uploads, including names like .php.jpg, and suspicious files.
- Instant alerts when a new administrator appearsNew admins, role changes and logins from unknown IPs, as they happen.
- Joomla core file integrity checks, even without official checksumsChecksums computed from the official Full Package, for Joomla 3, 4, 5 and 6.
- Vulnerability checks for plugins, themes and extensionsInstalled versions matched against Wordfence Intelligence and the Joomla Security Centre.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.