WordPress Integrity Checker
WordPress Integrity Checker
If your site is behaving strangely, loading slowly, or you suspect something is wrong, the Integrity Checker helps you find out whether any of your WordPress files have been tampered with. It compares every file on your server against the originals published by WordPress.org — flagging anything that has been modified, removed, or unexpectedly added. This is one of the fastest ways to confirm or rule out a malware infection after a security incident.
How It Works
FlyWP retrieves the official checksums (unique fingerprints generated from each file’s contents — like a digital seal of authenticity) for your installed WordPress version and each plugin. Here is what happens behind the scenes:
- FlyWP fetches the expected checksums from WordPress.org for your core version and plugins.
- FlyWP hashes every matching file on your server and compares it against the expected value.
- Any difference is categorized as modified, missing, or added (an unexpected file with no official counterpart).
- Results are displayed with the specific files affected so you know exactly where to look.
Check Statuses
As FlyWP runs a check, you will see one of these statuses:
| Status | Description |
|---|---|
| Pending | The check has been queued but has not started yet |
| Processing | Files are actively being compared against checksums |
| Completed | The check finished and results are available |
| Failed | The check could not complete — verify your site is accessible |
Running an Integrity Check
Navigate to your site’s Security tab and open the Plugin and Core Integrity Checks sub-tab. You have two options:
- On-demand — Click Scan Now to run an immediate check. Results appear in real time.
- Scheduled — Toggle the automated check to have FlyWP run integrity checks on a regular basis.
Understanding Results
Results are organized into two sections:
Core Files
This section lists any WordPress core files that differ from the official distribution. Common causes include:
- Malware injection that modifies core files to execute malicious code
- Manual edits made directly to core files (generally not recommended)
- Incomplete WordPress updates that left files in a mixed state
Plugin Files
This section lists any plugin files that differ from their official versions on WordPress.org. FlyWP skips custom or premium plugins that are not hosted on WordPress.org, since there is no official checksum to compare against.
Force Update
When the Integrity Checker detects modified or missing files, FlyWP gives you a Force Update action to reinstall the affected component cleanly:
- WordPress Core — Reinstalls all core files from the official WordPress release matching your current version.
- Individual Plugin — Reinstalls the plugin from WordPress.org, replacing any modified files with the originals.
Force Update overwrites files on your server. If you have intentional customizations to core or plugin files (not recommended), they will be lost. Always use child themes or custom plugins for modifications instead.
Scheduling Automated Checks
Rather than remembering to run checks manually, you can have FlyWP monitor your files automatically:
- Go to your site’s Security > Plugin and Core Integrity Checks tab.
- Toggle the Scheduled Check option to on.
- FlyWP runs integrity checks automatically and notifies you of any discrepancies.
Best Practices
- Run an integrity check after any suspected security incident.
- Schedule regular checks to catch unauthorized file changes early.
- Use Force Update to remediate compromised core or plugin files without manually re-downloading anything.
- Pair the Integrity Checker with the Vulnerability Scanner for broader security coverage — the scanner looks for known vulnerabilities in your plugin versions, while the Integrity Checker confirms whether the files themselves have been altered.