WordPress core checksums

When optional online diagnostics are allowed, WM Guard retrieves official checksums from WordPress.org and compares them with existing WordPress system files. The assessment focuses on executable or security-relevant differences such as PHP or JavaScript files; typical text and license files are not treated as attack indicators.

Uploads directory

Independently of the checksum comparison, WM Guard performs a bounded scan of the uploads directory for executable extensions such as PHP, PHTML, or PHAR. Such files are unusual there and should be reviewed.

Interpret matches technically

A discovered file is not automatically malware. Check its origin, modification time, and responsible plugin/theme context before deleting files.