DooFiles
File integrity
How DooFiles checks that the files of WordPress, of your plugins and of the products of Doothemes are the original ones, how to read the result of the Integrity tab, and what to do when a file was modified, is missing or should not be there.
Overview
A file of WordPress or of a plugin that changed when nobody updated it is a warning sign: it may be a mistake, or an attacker hiding malware where nobody looks. DooFiles checks that those files are the original ones. It compares each file with the official list for your version and shows you what does not match, in the Integrity tab of the Space view.
DooFiles only reads the files. It never changes, restores or deletes them.
File integrity needs DooFiles 1.0.7 or newer, and an active license.
How it works
The check runs with each scan of the Space view:
- when you click Scan now;
- once a day, when Measure the folders every day is on in DooFiles › Settings.
It starts after DooFiles measures your folders, and runs in the background in short rounds, so your site does not slow down. You can keep working while it runs: the Space view says Checking the files of WordPress or Checking the files of your plugins.
What it compares
| Files | Compared with |
|---|---|
WordPress: wp-admin, wp-includes and the files of WordPress in your main folder | The official list of WordPress.org for your version of WordPress |
| Plugins from WordPress.org | The official list of WordPress.org for the version you have |
| Plugins and themes of Doothemes: DooFiles, Dbmovies, Wovie and DooPlay | The official list of Doothemes for the version you have |
The check does not cover wp-config.php, your uploads, or plugins and themes from other places: there is no official list to compare them with. Plugins that come with WordPress, such as Akismet, are checked as plugins, not as part of WordPress, because they update on their own. The themes that come with WordPress are not checked.
Read the result
Open Space and click the Integrity tab. When something does not match, the tab shows the number of files in red.
[SCREENSHOT_HERE: The Integrity tab with WordPress showing 1 modified, plugins with Everything matches and one Cannot be verified, and the table with /index.php marked as Modified]
For WordPress and for each plugin or theme, the tab shows one of these:
| Result | What it means |
|---|---|
| Everything matches | Every file is the original one |
| 1 modified, 2 missing, 3 extra files | Some files do not match. The table below lists them |
| Cannot be verified | There is no official list for it: a plugin that is not on WordPress.org, a plugin of a single file, or a version of a product of Doothemes without signatures, such as an old one |
| Could not be checked | WordPress.org or Doothemes did not answer. DooFiles tries again with the next scan |
The table lists each file that does not match, and what it belongs to:
| Change | What it means |
|---|---|
| Modified | The file is different from the original one |
| Missing | The file is in the official list, but not on your server |
| Extra | The file is in wp-admin, wp-includes or the folder of a plugin or theme, but is not part of it. This is the usual sign of malware |
Click a file to open its folder in the file list, with the file highlighted. Up to 200 files of each kind are listed.
Below the table, DooFiles shows when the last check finished: Last check: Oct 25, 2026, 9:30 AM. While a new check runs, the tab keeps showing the last result.
What to do
| What you see | What to do |
|---|---|
| Files of WordPress modified or missing | Go to Dashboard › Updates and click Re-install version. WordPress replaces its files with the original ones; your content and settings stay |
Extra files in wp-admin or wp-includes | They are not part of WordPress. Open them and check what they are. If you did not put them there, they may be malware: ask your hosting provider or a security expert, and change the passwords of your administrators |
| Files of a plugin or theme from WordPress.org | Reinstall it from Plugins or Appearance › Themes, or check what changed |
| Files of a product of Doothemes | Download the same version from Downloads and install it again |
A developer may have changed a file on purpose. If you know why it changed, you can leave it as it is: the check will keep listing it.
In the Activity log
When a check finds files that do not match, DooFiles notes it in the Activity log: Integrity check, with 3 files do not match and the label Failed. A check where everything matches is not noted.
What leaves your site
To get the official lists, your server asks WordPress.org for the lists of your version of WordPress and of each plugin from WordPress.org, and asks Doothemes for the lists of its own products. It only sends their names and versions: never your files, your users or your content. Doothemes is never asked about other plugins.
DooFiles keeps the lists for a day, so it does not ask again with each scan.
Requirements
Your server must be able to connect to api.wordpress.org, downloads.wordpress.org and edge.wupdater.com over HTTPS. Some hosts block outgoing connections. See Server configuration.
Troubleshooting
| Problem | What to do |
|---|---|
| The Integrity tab says Not checked yet | Click Scan now in the Space view. The check runs after the folders are measured |
| The official list of WordPress could not be downloaded. Try again later. | Your server cannot reach WordPress.org. DooFiles tries again a day later. Check the outgoing connections of your server |
| A plugin or theme says Could not be checked | WordPress.org or Doothemes did not answer. It is checked again with the next scan |
| A product of Doothemes says Cannot be verified | Doothemes has no signatures for your version. Update it to the latest version |
| WordPress shows modified files I did not change | A plugin, your hosting or someone with access changed them. Reinstall WordPress in Dashboard › Updates and check who has access to your site |
| A file I fixed is still listed | The tab shows the last check. Click Scan now to check again |
Need more help? Open a support ticket.