Wordfence shows a diff. What am I looking for?

Added code, especially near the top or bottom of the file: eval, base64_decode, long encoded strings, or an include of a file in uploads/. Legitimate diffs are usually trivial — line endings, a host's banner comment. If the diff adds executable logic you cannot account for, assume compromise.

Can I let Wordfence repair the file?

Yes — 'repair' restores the official copy for your version, and for core files that is safe. But repair alone is the wrong instinct: if malware modified the file, the write access that allowed it still exists. Repair, then find how the file was writable to an attacker in the first place.

Could my host or a caching plugin have modified core?

Hosts occasionally patch core (some inject their object cache or tweak wp-config handling), and that produces persistent, explainable modifications. The tell is scope and content: a host tweak is one or two files with readable purpose, present on their other sites too. Unexplained logic in pluggable.php or wp-load.php is not a host being helpful.

Glossary · File change

A WordPress core file has been modified

Wordfence type: coreFile
Category: File change
Severity: High

A file that ships with WordPress no longer matches the official copy.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

WordPress core file modified: wp-includes/pluggable.php

What Wordfence found

Wordfence checksums core files against the official release. A mismatch means the file's contents differ from what WordPress.org distributes for that version.

Why it matters

Core files should never be edited. A modification is either a compromise, a well-meaning but dangerous hand-edit, or a host that patches core for its own reasons. All three are worth knowing about, and the first is the one that matters.

How to fix it

1View the difference — Wordfence can show what changed, and that usually settles the question immediately.
2If it is malicious or unexplained, reinstall core from the Updates screen, which replaces every core file.
3If a developer edited core deliberately, move the change into a plugin or a filter. It will be lost at the next update otherwise.
4If the host modified it, ask them why before overwriting.

Common questions

Wordfence shows a diff. What am I looking for?: Added code, especially near the top or bottom of the file: eval, base64_decode, long encoded strings, or an include of a file in uploads/. Legitimate diffs are usually trivial — line endings, a host's banner comment. If the diff adds executable logic you cannot account for, assume compromise.
Can I let Wordfence repair the file?: Yes — 'repair' restores the official copy for your version, and for core files that is safe. But repair alone is the wrong instinct: if malware modified the file, the write access that allowed it still exists. Repair, then find how the file was writable to an attacker in the first place.
Could my host or a caching plugin have modified core?: Hosts occasionally patch core (some inject their object cache or tweak wp-config handling), and that produces persistent, explainable modifications. The tell is scope and content: a host tweak is one or two files with readable purpose, present on their other sites too. Unexplained logic in pluggable.php or wp-load.php is not a host being helpful.

Findings that often appear with this one

An unknown file was found in a WordPress core directory File change
WordPress core needs an upgrade Vulnerability

How WPSecureOps treats it

The connector reports this as coreFile. WPSecureOps files it under File change and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.