Verifying WordPress Checksums Using WP-CLI

If you do not update WordPress core and your site’s plugins simultaneously, there is a possibility that malware or hackers may infiltrate your website. The WordPress Command Line Interface’s (WP-CLI) verify checksums commands make it simple to locate any non-standard WordPress core and plugin files on your website if malware has compromised it.

Preparing to Run Commands

At first, login to your portal via SSH.

Getting Started

While security plugins serve specialized functions, they are not the right instrument for cross-checking WordPress core and installed plugin checksums on WordPress.org. Just so you know, WP-CLI has checksum commands for every plugin and the core WordPress platform.

Checksums Commands

• Run the below command, to verify that all WordPress core files checksum match:wp core verify-checksums
• For verifying checksum against specific versions of WordPress, the version number can be added in the command. For example for verifying for version 5.2.1 of WordPress core, the command would be:wp core verify-checksums –version=5.2.1
• For an older version of WordPress, for example version 4.9.10, the command would be:wp core verify-checksums –version=4.9.10
• If you want to verify checksum of all plugins installed on your site server (this would only include plugins available from WordPress), then you would need to run the below command:

wp plugin verify-checksums --all

• For verifying the checksums of a specific plugin (e.g., WooCommerce), you will need to know the plugin “slug” (or short name). You can find it by searching in the plugins links on the WordPress website.

The WooCommerce’s plugin slug is woocommerce, so to verify the checksums of the WooCommerce plugin, you need to use the below command:

wp plugin verify-checksum woocommerce

Conclusion

Any non-standard PHP files or other files that shouldn’t be in WordPress directories will be shown by the core verify checksum or plugin verify checksum commands in WP-CLI. The files must be removed from your server (it is always advisable to make backups first) and then you can use the same verify checksums commands to make sure that no additional files shouldn’t be on your site server.

You may avoid stress by learning how to utilize simple WP-CLI commands to check the checksums of WordPress core files, plugins installed from WordPress.org, and those installed from WordPress.org. This is because you will be aware that certain folder directories do not include any non-standard files.

Generating A Self-Signed SSL Certificate Using cPanel and WHM