Clean core reinstall

When many WordPress core files are damaged, replacing the whole core with a clean copy is faster and safer than reviewing the files one by one. The plugin can do it for you with one click, or give you the exact steps to do it by hand.

When the card appears

A card titled "WordPress core looks damaged" appears on the Dashboard and on the Pending and Threats tabs of Reports when:

• five or more core files are affected: changed compared with the official files, flagged as threats, missing, or extra files in wp-admin or wp-includes; or
• any extra file that can run code sits in wp-admin or wp-includes. Those folders should only ever contain WordPress files, and an extra PHP file there is a classic backdoor.

With one to four changed files, use Restore official file on each report instead.

What is replaced, and what is never touched

Only these are swapped for the official files of your installed version:

• the wp-admin folder,
• the wp-includes folder,
• the core files in the WordPress folder itself (index.php, wp-login.php, wp-settings.php and the others on the official list).

Never touched: wp-config.php, the whole wp-content folder (plugins, themes, uploads, languages), .htaccess, .user.ini, php.ini, robots.txt, the guard file wpcybersec-guard.php, other plugins' files such as wordfence-waf.php, and any other file you added. Unknown PHP files in the WordPress folder stay and remain on the Reports page for a separate review. Extra files that were inside wp-admin or wp-includes leave with the old folders and stay only in the backup.

A core reinstall does not clean plugins, themes or uploads, and it keeps your site's language, because the language files live in wp-content.

Option B: one click

Press Reinstall clean core for me. The plugin:

1. Downloads the official package of your version from WordPress.org (the one without wp-content) and compares it with the checksum WordPress.org publishes for it.
2. Unpacks it, refusing any entry outside the package's own folders.
3. Checks every file against the official WordPress.org checksums, and that nothing extra is in it. Any difference stops the job with nothing changed.
4. Asks you to confirm, with the number of files and what goes into the backup.
5. Turns on maintenance mode for a few seconds, moves the old wp-admin and wp-includes into a backup folder, puts the verified ones in place and replaces the core files in the WordPress folder.
6. Checks that WordPress reports the right version and that the home page still answers. If not, everything is put back automatically. The same happens if PHP stops halfway.
7. Closes the core reports, trusts the new files and starts a quick scan.

Afterwards, change the password of every administrator and replace the secret keys and salts in wp-config.php (everyone has to log in again):

wp config shuffle-salts

Or get new keys from api.wordpress.org/secret-key/1.1/salt.

When one click is not available

The card says why, and opens the by-hand steps instead. Reasons include: DISALLOW_FILE_MODS is set, freeze mode is on, WordPress is installed with Composer, wp-admin or wp-includes is a symlink, the host manages WordPress core itself (WP Engine, Kinsta, Pantheon, WordPress.com, Pressable, Flywheel), ZipArchive is missing, WordPress cannot write files directly, a folder is not writable, or there is no place for the backup that the web cannot reach.

Rollback and restore

The old core is kept as a backup for 7 days, outside the web's reach, then deleted automatically. Server configuration files inside it are renamed so they cannot take effect. On the Dashboard, Restore the previous core puts it back with the same checks and automatic rollback, deletes the clean core and starts a quick scan, which reports the old files again. Use it only if something stopped working after the reinstall.

From the command line: wp wpcybersec core-reinstall (add --yes to skip the question before the swap).

Option A: by hand

Open Do it by hand, step by step on the card. The plugin fills in your WordPress version, folder, hosting panel and the exact list of core files; Download these steps (.txt) saves them for your developer. In short:

1. Take a full backup of the database and every file, and keep it until the site has been checked.
2. Download the clean "no-content" package of your exact version (about 25 MB), for example https://downloads.wordpress.org/release/wordpress-6.8.3-no-content.zip. The card's Download the package button gives the right one.
3. Open your hosting file manager (or an SFTP program such as FileZilla, Cyberduck or WinSCP) and go to the WordPress folder.
4. Upload the zip into the WordPress folder before you delete anything, so the site is down for a minute only.
5. Turn on maintenance mode with the card's Turn on maintenance mode button (WordPress lifts it after 10 minutes), or create a file named .maintenance in the WordPress folder with this line:

<?php $upgrading = time();

6. Delete the wp-admin and wp-includes folders completely.
7. In the WordPress folder delete exactly the core files the card lists, nothing else. For most versions these are: index.php, license.txt, readme.html, wp-activate.php, wp-blog-header.php, wp-comments-post.php, wp-config-sample.php, wp-cron.php, wp-links-opml.php, wp-load.php, wp-login.php, wp-mail.php, wp-settings.php, wp-signup.php, wp-trackback.php and xmlrpc.php.
8. Extract the zip in the WordPress folder. It creates a folder named wordpress.
9. Move everything inside that wordpress folder one folder up. wp-admin and wp-includes must end up directly in the WordPress folder, next to wp-config.php.
10. Delete the zip, the empty wordpress folder and the .maintenance file.
11. Open the site, log in again and run a full scan (Dashboard > Full malware scan). The core reports close by themselves.
12. Change every administrator password and the keys and salts, as above.

In cPanel the file manager is Files > File Manager (right-click the zip and choose Extract); in Plesk it is Websites & Domains > Files (open the zip's menu and choose Extract Files). The card names the menus of your panel.

With SSH

This block checks that it runs in the WordPress folder, downloads the package, compares it with its published checksum, deletes only the core folders and files, copies the clean ones in and cleans up. It runs in a subshell, so an error does not close your session. The plugin shows it with your folder, version and file list filled in; this example uses /var/www/example.com and version 6.8.3:

(
set -e
cd /var/www/example.com
if [ ! -f wp-config.php ] || [ ! -d wp-content ]; then echo "Stopped: wp-config.php or wp-content is missing here, so this is not the WordPress folder."; exit 1; fi
command -v curl >/dev/null || { echo "Stopped: curl is not installed."; exit 1; }
VER='6.8.3'
URL="https://downloads.wordpress.org/release/wordpress-$VER-no-content.zip"
TMP=$(mktemp -d)
curl -fsSL -o "$TMP/wp.zip" "$URL"
SUM=$(curl -fsSL "$URL.sha1")
GOT=$( (sha1sum "$TMP/wp.zip" 2>/dev/null || shasum -a 1 "$TMP/wp.zip") | cut -d" " -f1 )
if [ -z "$SUM" ] || [ "$GOT" != "$SUM" ]; then echo "Stopped: the download does not match its published checksum."; rm -rf "$TMP"; exit 1; fi
if command -v unzip >/dev/null; then unzip -q "$TMP/wp.zip" -d "$TMP"; else php -r '$z = new ZipArchive(); exit( true === $z->open( $argv[1] ) && $z->extractTo( $argv[2] ) ? 0 : 1 );' "$TMP/wp.zip" "$TMP"; fi
if [ ! -f "$TMP/wordpress/wp-includes/version.php" ] || [ ! -f "$TMP/wordpress/wp-admin/index.php" ]; then echo "Stopped: the package could not be unpacked."; rm -rf "$TMP"; exit 1; fi
OWNER=$(stat -c "%u:%g" wp-content 2>/dev/null || stat -f "%u:%g" wp-content)
echo "<?php \$upgrading = $(date +%s);" > .maintenance
rm -rf wp-admin wp-includes
rm -f index.php license.txt readme.html wp-activate.php wp-blog-header.php wp-comments-post.php wp-config-sample.php wp-cron.php wp-links-opml.php wp-load.php wp-login.php wp-mail.php wp-settings.php wp-signup.php wp-trackback.php xmlrpc.php
cp -R "$TMP/wordpress/." .
if [ "$(id -u)" = "0" ]; then chown -R "$OWNER" wp-admin wp-includes index.php license.txt readme.html wp-activate.php wp-blog-header.php wp-comments-post.php wp-config-sample.php wp-cron.php wp-links-opml.php wp-load.php wp-login.php wp-mail.php wp-settings.php wp-signup.php wp-trackback.php xmlrpc.php; fi
rm -f .maintenance
rm -rf "$TMP"
echo "Done: the WordPress core files were replaced. Now run a full scan in Qartvelo Guard."
)

With WP-CLI, check the result afterwards; it lists every core file that still differs:

wp core verify-checksums

Composer and managed hosts

When WordPress is installed with Composer (including Bedrock), the card shows composer reinstall for the WordPress package instead of delete steps. On hosts that manage WordPress core themselves, ask their support to reinstall a clean core or restore the site from a backup.