Use the correct installation path and record the installed WordPress version and locale. The comparison must use the appropriate release information, particularly after a partial update or a non-default language package.

Preserve suspicious files and relevant logs before replacing anything. A checksum mismatch is evidence to investigate, not automatic permission to delete every reported file.

wp core verify-checksums --path=/path/to/wordpress

Replace the path with the verified installation directory. Review the documented version and locale options if the detected values do not match the intended package. The command avoids loading WordPress for the verification itself, which is useful when investigating a damaged installation.

1. Record missing or modified core files and any unexpected files reported by the selected options.
2. Compare the findings with known deployments or interrupted updates.
3. Check whether checksum retrieval failed because of network or package availability rather than a file mismatch.
4. Have a developer or support review unexplained changes before applying a trusted-package repair.

The check does not validate all uploads, custom code, commercial plugins, account configuration or database records. A malicious file outside the checked core set can remain even when core verification succeeds.

Plugin checksum verification is a separate operation and may not be available for every package or release. An unavailable checksum does not itself prove that the plugin is malicious, but it requires another trustworthy verification route.

If core files need replacement, preserve configuration and content and use a supported trusted release process. Do not overwrite wp-content or the database as part of a generic core repair.

After correction, rerun the check and test the website. If compromise is suspected, investigate the entry point, privileged users and other writable code as part of the broader incident response.

Send support the version, locale, command and sanitised output. Avoid excluding unexplained files merely to obtain a green result. The purpose is to establish the actual file state and its cause, not to suppress the evidence.

• Using WP-CLI safely on a hosting account with several sites
• Listing plugins and themes with WP-CLI for support
• Securing a WordPress website with practical maintenance and access controls
• Checking WordPress cron events with WP-CLI

• WordPress developer documentation
• WP-CLI security checks