Check your WordPress files for tampering
Compare WordPress's own files and your WordPress.org plugins with the official copies, and find out whether anything was changed or is missing.
- Difficulty
- Intermediate
- Time
- about 10 min
I am worried my WordPress site may have been tampered with because [reason, e.g. visitors see strange redirects]. Compare WordPress's own files with WordPress.org's and tell me about any changed or missing file. Do the same for [plugins, e.g. every active plugin from WordPress.org]. For a changed plugin file, read it and tell me in plain words what looks out of place. Also list the administrators so I can spot one I do not know. Do not change anything; tell me what to do next.
Already connected?
If SAR is already in your AI app, this is enough:
Check WordPress and my plugins against WordPress.org and tell me what was changed.
What happens
- The AI app compares WordPress's own files with WordPress.org's checksums.
- It lists your plugins and checks the WordPress.org ones the same way.
- For a changed plugin file, it reads the file (with secrets hidden) and explains what looks odd.
- It lists the users and their roles so you can spot an administrator you do not know.
- It suggests next steps, such as reinstalling a plugin or calling your host; it changes nothing itself.
Approvals involved
Nothing here changes your site: no approval needed.
wordpress_verify_checksumsCheck files against WordPress.orgNonewordpress_list_pluginsList pluginsNonewordpress_read_code_fileRead plugin or theme codeNonewordpress_list_usersList usersNone
What you get
A clear answer on whether your core and plugin files match the official ones, and what to do if they do not. Every file read is recorded in the site's audit log.
Related recipes
- Security & backups · about 10 minCheck that your backups are actually runningFind out which backup plugin you use, how old the last good backup is, whether a scheduled backup is overdue, and what to look at if backups stopped.
- Security & backups · about 10 minSucuri's status, with WordPress files and waiting updates checkedSee what Sucuri reports about your site, compare WordPress's files with WordPress.org's, and list the updates still waiting.
- Security & backups · about 15 minAdministrators you don't recognise, found and taken down a levelList everyone who can manage your whole site, spot accounts you don't know, lower their role with your password, and send password resets where needed.
Try it on your own site
Install the plugin, add SAR to your AI app and paste the prompt. Free to start.