WP-Cron is WordPress’s built-in task scheduler. Instead of using a real operating system cron service, it checks for due jobs when a visitor loads the site. Those jobs can handle maintenance, publishing, cache cleanup, and plugin tasks. Because it is triggered by web traffic, WP-Cron is convenient, but it is also less predictable than a server-side cron job.
In cyber security, that timing model matters. Attackers may abuse scheduled events to relaunch malware, restore deleted files, or run follow-up code after a cleanup. Defenders should inspect scheduled hooks and compare them with trusted baselines, especially when malware persists after file removal. Unexpected or hidden WP-Cron entries can be a sign of compromise, and disabling malicious jobs is often necessary before a site can be considered clean.