Ensuring Integrity: How to Audit Your WordPress Site Using WP-CLI

Maintaining a WordPress site involves more than just updating plugins and themes. To ensure your site is secure and that no core files have been tampered with—whether by a malicious actor or an accidental edit—you need to verify its integrity.

The most efficient way to do this is via WP-CLI, the command-line interface for WordPress. In this post, we will look at how to use the verify-checksums command and other essential tools to audit your installation.

Why Checksums Matter

A checksum is a mathematical fingerprint of a file. WordPress.org provides checksums for every version of its core files and most plugins. By comparing your local files against these fingerprints, WP-CLI can tell you instantly if a file has been modified, added, or deleted.

1. Verifying WordPress Core Files

The first step in any audit is ensuring the core WordPress files are “clean.” If a hacker injects code into a standard file like wp-settings.php, this command will catch it.

Run the following command in your site’s root directory:

wp core verify-checksums

If everything is correct, you will see a success message. If there is a mismatch, WP-CLI will list the specific files that have been modified.

Pro Tip: To include root files that aren’t strictly part of the core (like .htaccess or wp-config.php), you can use:

wp core verify-checksums --include-root

2. Verifying Plugin Integrity

Just like the core, plugins are common targets for injections. You can verify all your installed plugins against the official WordPress.org repository.

wp plugin verify-checksums --all

Note: This command only works for plugins hosted on the official WordPress.org Plugin Directory. Premium plugins or custom-coded tools will return a warning because WP-CLI has no “source of truth” to compare them against.

3. Checking the Database

Integrity isn’t just about files; it is about the database too. You can perform a quick health check on your MySQL tables directly through WP-CLI:

wp db check

This uses the underlying MySQL toolset to ensure that none of your tables are corrupted.

4. Identifying “Ghost” Files

Sometimes, the issue isn’t that a file was modified, but that a new, malicious file was added (like a backdoor). While verify-checksums identifies modified files, you can also look for files that shouldn’t be there.

A quick way to list files in the core directories that aren’t recognized by WordPress is to use the --reveal flag:

wp core verify-checksums --reveal

5. Checking for Updates

Security often comes down to staying current. Before you finish your audit, check if your core, plugins, or themes are out of date:

wp core check-update
wp plugin list --update=available
wp theme list --update=available

What to do if a Checksum Fails?

If wp core verify-checksums fails, it means your files do not match the official source.

1. If it’s a core file: You can often fix this by forcing a core download to overwrite the modified files:

   wp core download --version=$(wp core version) --force

2. If it’s a plugin: Reinstall the plugin:

   wp plugin install [plugin-name] --force

Conclusion

WP-CLI is an indispensable tool for site administrators. By incorporating verify-checksums into your regular maintenance or CI/CD pipelines, you can catch security breaches and file corruption long before they impact your users.

Regular audits keep your site fast, secure, and reliable. Happy blogging!