◦ Comprehensive security
◦ 24/7 support
WordPress Guide → WP-CLI → WordPress Checksums
How to verify WordPress checksums using WP-CLI
Verifying WordPress checksums using WP-CLI
If you do not keep site plugins updated along with WordPress core updated, then you run into the chance of your site being hacked or infected by Malware. If your site does get infected by malware, a way to easily find any of the non-standard WordPress core and plugin files is by using the verify checksums commands in the WP-CLI (WordPress Command Line Interface).
Get fast, reliable hosting for WordPress
Power your site with the industry’s fastest, most optimized WordPress hosting
Preparing to run commands
First, you will need to login to your portal via SSH. For directions on generating credentials for sFTP/SSH creds from your site manager, see Finding Your SFTP/SSH Credentials in Managed WordPress Portal. For help using SSH, see Logging into Your Server via Secure Shell (SSH).
Checksum commands
For WordPress core files
To verify that all WordPress core files checksum match, the WP-CLI command to run is:
wp core verify-checksums
For a specific version of WordPress core files
To verify checksum against specific versions of WordPress, you can include the version number in the command. To verify for version 6.1 of WordPress core, for example, the command would be:
wp core verify-checksums –version=6.1
If you were using an older version of WordPress, for example version 6.0.3, the command would be:
wp core verify-checksums –version=6.0.3
For all plugins
To verify the checksum of all plugins which are installed on your site server (this would only include plugins available from WordPress), then the command to run would be:
wp plugin verify-checksums –all
For a specific plugin
To verify the checksums of a specific plugin (e.g., WooCommerce), you will need to know the plugin “slug” (or short name). You can find the slug by looking in the plugin links on the WordPress website.
The plugin slug for WooCommerce is woocommerce, so to verify the checksums of the WooCommerce plugin, the command would be:
wp plugin verify-checksum woocommerce
Getting started with verifying WordPress checksums
The files that the core verify checksum or the plugin verify checksum commands in WP-CLI will display will be any of the non-standard PHP or other files that should not exist in WordPress folders. The files should be deleted (it’s always a good idea to take backups before deleting data from your server). and then you can rerun the same verify checksums commands to check that there are no other files which should not exist on your site server.
When you’re ready to upgrade your WordPress hosting, Liquid Web can help. We’ve been offering the premium hosting for WordPress sites for decades—with the fastest speeds, best uptime guarantees, and most robust security features. Click below to explore options or start a chat to connect with one of our WordPress hosting experts right now.
Knowing how to verify the checksums of WordPress core files, all plugins installed from WordPress.org, and specific plugins installed from WordPress.org using simple-to-use WP-CLI commands will give you peace of mind in knowing that there are no non-standard files that exist in those folder directories.
Additional resources
What is WordPress? →
A complete beginner’s guide—from use cases, to basics, to how to get started
Installing WordPress using WP-CLI →
With your SSH credentials, learn how to install WordPress using the WordPress Command Line Interface (WP-CLI) after creating a database for the new WordPress install.
How to integrate WordPress and Slack →
If your org uses Slack and WordPress, there are several ways you can tie them together.
Luke Cavanagh, Strategic Support & Accelerant at Liquid Web, is one of the company’s most seasoned subject matter experts, focusing on web hosting, digital marketing, and ecommerce. He is dedicated to educating readers on the latest trends and advancements in technology and digital infrastructure.