# Daily Core File Integrity Check

> Compares your WordPress core files with the official checksums once a day and emails the administrator if any file was changed or is missing.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, integrity, cron
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/daily-core-integrity-check/

## Code

```php
add_action( 'init', function () {
    if ( ! wp_next_scheduled( 'wpide_core_integrity_check' ) ) {
        wp_schedule_event( time() + HOUR_IN_SECONDS, 'daily', 'wpide_core_integrity_check' );
    }
} );

add_action( 'wpide_core_integrity_check', function () {
    global $wp_version, $wp_local_package;

    require_once ABSPATH . 'wp-admin/includes/update.php';

    $checksums = get_core_checksums( $wp_version, isset( $wp_local_package ) ? $wp_local_package : 'en_US' );

    if ( ! is_array( $checksums ) ) {
        return; // The checksum service could not be reached; try again tomorrow.
    }

    $problems = array();
    $optional = array( 'readme.html', 'license.txt', 'wp-config-sample.php', 'xmlrpc.php' ); // Often removed on purpose.

    foreach ( $checksums as $file => $md5 ) {
        if ( 0 === strpos( $file, 'wp-content/' ) || ( in_array( $file, $optional, true ) && ! file_exists( ABSPATH . $file ) ) ) {
            continue;
        }

        $path = ABSPATH . $file;

        if ( ! file_exists( $path ) ) {
            $problems[] = 'Missing: ' . $file;
        } elseif ( md5_file( $path ) !== $md5 ) {
            $problems[] = 'Modified: ' . $file;
        }
    }

    if ( $problems ) {
        wp_mail(
            get_option( 'admin_email' ),
            sprintf( '[%s] WordPress core files changed', wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) ),
            "These core files differ from the official WordPress " . $wp_version . " release:\n\n" . implode( "\n", array_slice( $problems, 0, 100 ) ) . "\n\nIf you did not change them, reinstall WordPress from Dashboard > Updates and scan the site."
        );
    }
} );
```

## Notes

Contacts api.wordpress.org once a day, and the scheduled event stays registered but idle after deactivation.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Daily Core File Integrity Check" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/