Run wp core verify-checksums from the site's folder. WP-CLI downloads the MD5 checksums for your WordPress version from WordPress.org and compares them with the installed core files. A clean run prints a success line. Any changed or unexpected file is listed as a warning, and the command exits with an error.
What the handbook says it does
The WP-CLI handbook states that the command downloads md5 checksums for the current version and compares them against the installed files. For security it avoids loading WordPress while verifying, which matters because a compromised site cannot be trusted to report on itself. It also runs on the before_wp_load hook.
If verification fails unexpectedly, the handbook advises passing the locale and version values shown on the Updates screen in the admin area.
Steps
- Open a shell on the server and go to the site.
- Run the command with no options for a first check.
- If it fails, read each listed file. Core files such as wp-includes/version.php should not differ.
- For a stricter sweep, use the include-root option, which also checks the root directory and warns about items that are not part of WordPress.
- Exclude known harmless files with the exclude option, for example a customized readme.
wp core verify-checksums
wp core verify-checksums --format=json
Reading the result
| Output | What to do |
|---|---|
| Success line | Core files match. Move on to plugins and themes |
| File does not verify | Treat as suspect. Compare with a fresh download of the same version |
| Unexpected file in the root (with include-root) | Investigate who added it and why |
| Locale mismatch warnings | Re-run with the locale and version from the Updates screen |
Limits you should know
Core checksums only cover core. Most real compromises on agency sites arrive through plugins, themes, or stolen credentials, and a changed plugin file will not show up here. They also do not cover the uploads folder or the configuration file, where attackers often hide code.
Use it together with the plugin check described in our plugin checksum post, and with a regular inventory of what is installed.
The handbook also warns that the insecure option retries downloads without certificate validation if TLS fails, which makes the request vulnerable to a man in the middle attack. Leave it off.
When a check fails
Do not clean up first. Take a copy of the failing files and note timestamps, because they tell you when something changed and help you decide whether it was an edit by a person or an intrusion. Then replace core with a fresh download of the same version, which is safe because core should hold no custom code. Reset credentials for the site, check for new administrator accounts, and review plugins, themes and the uploads folder, since the core check does not look there.
A failure on a single documentation file such as the readme is often harmless, but confirm that rather than assume it.
Quick check
Does a passing core check mean the site is clean?
No. It only shows core files are unmodified. Plugins, themes, uploads and the database are separate.
Why does it avoid loading WordPress?
So that a tampered site cannot interfere with its own check.
Sources
Last reviewed: 19 October 2026.
