wp core verify-checksums compares core files with published values for the selected version and locale. Differences may indicate manipulation, corruption, or an incorrect version parameter and require individual assessment.
- database and injected posts
- wp-content/uploads
- custom code without a reference source
- users, sessions, and application passwords
- web-server and scheduler configuration
“Core checksums match” means only that the checked core area matches.
Combine checksums with file inventory, signatures, manual review, database and account analysis. Replace unverifiable code or record it as a remaining uncertainty.
What does a mismatch mean?
A differing file may be malicious, incompletely updated, locally customized, or corrupted. Preserve its path, hash, content, and timestamps before replacement. Version, source, logs, and behaviour provide the context needed to classify it.
Missing files also require review. Extra files in a core directory do not become legitimate merely because every official file matches.
Why are plugin checksums sometimes unavailable?
Public components may have reliable reference packages. Premium, custom, or withdrawn plugins instead require a vendor package or controlled repository. Without a baseline, analysis may find suspicious behaviour but cannot mathematically prove that the code matches its intended state.
What remains outside checksum coverage?
Review uploads, must-use plugins, drop-ins, themes, database content, users, sessions, cron, web-server rules, and parent hosting paths. The persistence guide explains why a matching core covers only one trust zone.
Run comparisons on a working copy where appropriate or document the exact commands. After trusted replacement, repeat integrity and functional checks.