Changed WordPress core files: checking and reinstalling the originals
PrintIn short: WordPress core files should never change between two updates. If a check reports differences, assume the site may have been attacked: scan the account with Imunify360, reinstall the core from WP Toolkit (or from the WordPress dashboard), then hunt for anything else left behind and update everything.
Which files we are talking about
The core consists of the wp-admin and wp-includes folders plus the files in the installation's root, such as index.php, wp-login.php or wp-settings.php. For a given WordPress version they are the same on every site, which is why they can be compared with the originals published on wordpress.org. Not part of the core: wp-config.php, .htaccess and everything inside wp-content (themes, plugins, images).
How you may find out
- In cPanel, in WP Toolkit ("WordPress Management"): on the site's page click Security, then Check WordPress Integrity and Verify Checksums.
- From the Imunify360 results (cPanel, Security section) or from a security plugin that compares files.
- If you work over SSH: the command
wp core verify-checksums, run in the site's folder.
Why differences appear
| Cause | How often | What it means |
|---|---|---|
| Code hidden by an attacker | Most often | The site is compromised; clean it and find the way in |
| Manual edits by a developer | Rarely | Bad practice: the edits vanish at the next update |
| An interrupted update | Now and then | Some files stayed on the old version; a reinstall fixes it |
The plan
Step 1. Keep the evidence and scan
Do not restore a backup or delete anything yet: the traces of the attack help locate its cause. JetBackup keeps copies in a 30-day rotation, so there is time. Open Imunify360 in cPanel and read the results. If infected files are listed, deal with those first: An Imunify notice about infected files.
Step 2. Put the original core back
A reinstall overwrites the core with a clean copy for your WordPress version. Posts, themes, plugins and the database are left as they are.
- From cPanel (recommended): WP Toolkit, the site's page, Security, then Reinstall WordPress Core after the checksum check. This also works when you cannot reach wp-admin.
- From WordPress: Dashboard, then Updates, then the Re-install version button, which is shown even if you already run the latest release.
Run the check once more after the reinstall: no differences should remain.
Step 3. Look for what the attacker left
Reinstalling the core does not touch wp-content. So go through this list:
- Users, filtered by Administrator: remove unknown accounts and give the real ones new passwords.
- PHP files inside
wp-content/uploads. That folder only holds images and documents, so any PHP file there is a red flag. - Plugins or themes you never installed.
wp-config.phpand.htaccess: compare them with what you know you had. A clean example is in Setup .htaccess file for popular CMS.- Passwords: WordPress administrator, cPanel, FTP and the database.
Step 4. Close the door
Update WordPress, every plugin and every theme. If one of the extensions had a published flaw, that is the likely way in: Security flaw reported in a WordPress plugin or theme. As an extra measure, turn off the dashboard file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
When to ask us
If you are not sure what changed, or the problem keeps coming back, open a ticket before reinstalling the whole site. We can help you choose a JetBackup copy from before the change. You can also run the restore yourself: How to restore a website or specific files using JetBackup 5.
