WordPress Hosting includes platform protections such as a web application firewall, DDoS protection and malware scanning. These work alongside, not instead of, maintaining your WordPress website.
Check WordPress Core Files
Open WordPress Tools in your hosting control panel and select WordPress Checksum Report.
This tool compares your WordPress core files with the official WordPress core repository. If files differ from the expected versions, it reports the changes.
Unexpected differences may indicate modified, damaged or malicious files, but a checksum mismatch alone does not confirm an infection.
Important: This report checks WordPress core files. It is not a complete security audit of your plugins, themes, uploads or database.
If a Checksum Check Reports Changes
-
Review the reported differences.
-
Consider whether a developer intentionally modified the files.
-
Run the available on-demand malware scan.
-
Contact support if the changes are unexplained.
-
Check that a recoverable backup exists before replacing or removing files.
Do not use WordPress Reinstall as a routine response: it deletes the existing website files and database.
Replacing WordPress core files without deleting website content is a different operation. If core files need repair, ask support or your developer to help choose the appropriate method.
Maintain Your Website’s Security
-
Keep WordPress, themes and plugins updated.
-
Remove software you no longer use.
-
Use strong, unique passwords.
-
Enable WordPress two-factor authentication using a maintained solution.
-
Give users only the permissions they need.
-
Install themes and plugins from trusted sources.
-
Keep HTTPS enabled.
-
Review malware and security alerts promptly.
If You Suspect a Compromise
Contact support with the symptoms and any scan results. Avoid deleting files or restoring an older database without considering recent customer activity and the possible cause of the compromise.
If restoring from backup, use a known-good restore point from before the infection. A partial restoration may leave malicious files behind.
After recovery:
-
Update WordPress, plugins and themes.
-
Remove unused or untrusted software.
-
Reset WordPress administrator passwords.
-
Arrange a database password change and update the website configuration accordingly.
-
Review user accounts and permissions.
-
Run another malware scan.
Restoration may recover the website, but the underlying vulnerability must also be addressed. Specialist security assistance may be needed if an infection persists.
