Sort By Owner
File integrity review starts by ownership. Core files, plugins, themes, uploads, cache, and custom code each have different expected-change rules.
Problem
WordPress File Integrity Review Guide
Review WordPress core, plugin, theme, upload, and custom-code file changes without confusing legitimate updates with suspicious modification.
Problem, cause, fix, verify
Problem
File-change evidence is useful only when each file is tied to an owner, expected update, deployment event, or suspicious behavior.
Audience
WordPress administrators, developers, agencies, and support teams reviewing changed files.
First check
File integrity review starts by ownership. Core files, plugins, themes, uploads, cache, and custom code each have different expected-change rules.
Verify
WPlura Security Center can help frame file-risk findings and handoff notes, while Diagnostics and Backup & Restore Manager support verification and rollback planning.
Editorial trust
- Publisher
- WPlura Editorial Team
- Published
- Updated
- Content type
- Problems
On this page
Symptom
File-change evidence is useful only when each file is tied to an owner, expected update, deployment event, or suspicious behavior.
For: WordPress administrators, developers, agencies, and support teams reviewing changed files.
Diagnosis
What to check before changing the site
Use Clean Sources
For core, plugins, and themes, compare against trusted packages instead of editing suspicious code in place. Replacement is often safer than manual cleanup.
Treat Uploads Differently
Normal uploads are media and documents. Executable PHP or unfamiliar scripts in upload paths deserve careful review, especially if they are reachable from the public web.
Protect Custom Work
Custom code can be legitimate and business-critical. Preserve diffs and ask the owner before replacing custom files that are not clearly malicious.
WPlura Fit
WPlura Security Center can help frame file-risk findings and handoff notes, while Diagnostics and Backup & Restore Manager support verification and rollback planning.
WordPress SecuritySeverity: HighLast reviewed: 2026-09-16
Diagnosis
Symptoms, causes, checks, and fixes
Symptoms
- A scan reports modified core, plugin, theme, upload, cache, or custom files.
- Files changed outside the expected update window or under paths that should contain only media.
- The team cannot tell whether a changed file came from an update, developer edit, deployment tool, or attacker.
Most Common Causes
- Normal updates, deployment scripts, page builders, cache rebuilds, and malware can all change files.
- Upload directories and public backup paths can become hiding places for executable files.
- Editing suspicious files directly can destroy evidence and leave related persistence untouched.
How To Confirm The Cause
- Group files by core, plugin, theme, must-use plugin, uploads, cache, backup, and custom-code ownership.
- Compare core and plugin files with clean packages, changelogs, deployment records, and expected custom work.
- Check timestamps, file owners, permissions, executable extensions, and whether public URLs can reach the file.
Fixes
- Replace untrusted core/plugin/theme files from clean trusted packages.
- Send custom-code differences to the responsible developer instead of overwriting business logic blindly.
- Remove confirmed malicious upload executables and block execution in upload paths where hosting supports it.
How To Verify The Fix
- Rerun the same file review and confirm only expected differences remain.
- Load representative public pages, wp-admin, forms, checkout if active, and scheduled tasks after replacement.
- Document files replaced, files kept, unresolved custom-code questions, and next scan date.
When To Contact Support
Escalate when modified files include payment, membership, custom plugin, server-level, or unknown obfuscated code.
References