Overview
WP Toolkit can review supported WordPress security settings and check the integrity of WordPress core files.
These functions improve security but do not constitute a complete malware scan or guarantee that a website is uncompromised.
Run a Security Check
- Open WP Toolkit.
- Select the installation.
- Click Check security.
- Wait for the scan to finish.
- Review each recommendation.
- Select only the measures you understand.
- Click Secure to apply them.
- Test the website.
Before Applying Security Measures
- Create a full backup.
- Read the description of each measure.
- Apply changes in small groups.
- Test APIs, forms, integrations, and administrator functions.
- Record any setting that may need to be rolled back.
Certain restrictions can affect custom plugins, themes, publishing tools, APIs, or external services.
Verify WordPress Core Integrity
- Locate Check WordPress integrity.
- Click Verify Checksums.
- Review modified, missing, or unexpected core files.
A checksum mismatch does not automatically prove compromise. A core file may have been changed manually or during a failed maintenance operation. Unexpected changes should nevertheless be investigated.
Reinstall WordPress Core Files
If WP Toolkit offers to reinstall core files:
- Create a full backup.
- Confirm that no intentional customization exists inside WordPress core.
- Reinstall only the core files.
- Test the website afterward.
This normally does not delete website content, themes, or plugins, but a backup remains essential.
WP Toolkit Security Limitations
Security checks and checksum verification do not replace:
- Strong passwords
- Multi-factor authentication
- Regular updates
- Malware monitoring
- A web application firewall
- Secure plugin and theme selection
- Least-privilege user access
- External backups
- Incident investigation
A clean WordPress core check also does not confirm that plugins, themes, uploads, or the database are clean.
When to Request Assistance
Contact support or your website security specialist if:
- Unknown administrator accounts appear.
- Files return after deletion.
- Visitors are redirected unexpectedly.
- Search engines report harmful content.
- Malware is detected.
- Website files change without authorization.
- The website sends spam.
- The same compromise returns after cleaning.
