What are allowed files in the WordPress core and core directories?

When Melapress File Monitor scans your WordPress Core Files, it compares their hash values with the hash values of the files in the official WordPress repository. Through this comparison, the plugin can alert you whenever:

• Any of your WordPress core files do not match their counterpart in the WordPress repository
• There are files in any of your WordPress Core Files directories that are not present in their WordPress repository counterpart

By default, the plugin assumes that any discrepancy is a security risk and notifies you as such. However, additional or altered files can have legitimate purposes – when placed there intentionally to, for example, add custom processes or functionality. In such cases, these files can be included as allowed files and thus excluded from future alerts.

IMPORTANT: It’s important to note that custom files are not immune from malicious tampering. As such, you might want to consider using the file comparison scan to ensure that you can uncover any unauthorized changes.

This post explains what non-WordPress core files are, why the plugin notifies you of them, and how you can configure the plugin to handle these files as legitimate files.

What is the WordPress core?

WordPress is made up of a number of files, all of which can be found in your website’s root directory. The only exception here is the wp-content folder, which is where plugins, themes, and uploads are stored.

As a security precaution, any other files saved outside the wp-content folder are considered malicious by the plugin.

For example, if during a file integrity scan, the plugin identifies an info.php file in your website root directory, it will alert you about it each time. This is a security precaution because, by default, there is no info.php file in the WordPress core directory. 

If you are aware of the file and its purpose, you can add it as an allowed file in the WordPress core. This will exclude it from future alerts following a scan.

What are allowed files?

Allowed files are non-WordPress core files (such as those from a custom web application) saved in your WordPress core directory that the plugin is aware of. This excludes them from future alerts.

How do you add a file (or all files in a directory) to the list of allowed files?

You can add files or folders in one of two ways – through the plugin settings or scan results.

From plugin settings

First, navigate to File Monitoring > Settings > WordPress core

Scroll down to the Which files are allowed as part of WordPress core (website root directory, wp-admin and wp-includes)? section. Add files by typing the filename and extension in the available textbox and clicking on Add. Make sure you click on Save once done for the changes to take effect.

You can also remove any of the files allowed by default by clicking on the checkbox next to them.

From scan results notification

To exclude the file or its directory from being included in future scans:

• Click the x in the File modified field to exclude the file 
• Click the x  in the Directory field to exclude the directory