Check WordPress Core files integrity

Photo of author
Written By Jan Reilink

Windows Server systems administrator & enthusiast.

Check WordPress integrity, verify WordPress Core files md5 checksums against WordPress’ checksums API, using this standalone PHP file. I chose to use a standalone PHP script to check the md5sum of WordPress Core files against the API so you’re not dependent on a possibly hacked WordPress installation. This kind of guarantees the result can be trusted, as opposed to using a WordPress plugin. I think this is a better integrity check of WordPress Core files.

What do you think of this approach? Let me know through the comments, thanks!

Because it is a standalone PHP script, and not part of WordPress ecosystem, you need to include wp-includes/version.php. Otherwise you are not able to use the $wp_version and $wp_locale variables that are required.

“I trust you”, do we trust the WordPress PHP files we have on our systems? Or is the integrity not checked?

Jan Reilink

Copy and paste the following code into a new file and upload the file to your WordPress root folder.

<?php if ( version_compare( PHP_VERSION, '5.6.29', '<' ) ) { die( 'You are using PHP Version: ' . PHP_VERSION . '. I think you should use a higher PHP version, at least 5.6.29! (change the PHP version check if you must...) ' ); } define('ABSPATH', './'); if ( defined( 'ABSPATH' ) ) { include( ABSPATH . 'wp-includes/version.php' ); $wp_locale = isset( $wp_local_package ) ? $wp_local_package : 'en_US'; $apiurl = 'https://api.wordpress.org/core/checksums/1.0/?version=' . $wp_version . '&locale=' . $wp_locale; $json = json_decode ( file_get_contents ( $apiurl ) ); $checksums = $json->checksums; foreach( $checksums as $file => $checksum ) { $file_path = ABSPATH . $file; if ( file_exists( $file_path ) ) { if ( md5_file ($file_path) !== $checksum ) { echo "HELP! Checksum for " .$file_path ." does not match!"; } } } } ?>
Code language: PHP (php)

Now run the file in your browser. No result means everything is OK.

Searching for backdoors in PHP files

When going through a hacked WordPress searching for backdoors, there is not really an advantage in verifying core files checksums first. One might say you don’t have to scan files which checksums match, but in my opinion you just have to scan everything.

So if you found this article interesting, you may also like my post using grep to search for backdoors. The post contains a lot of useful grep examples and information, use it wisely.


Did you like: Check WordPress Core files integrity

Then please, take a second to support Sysadmins of the North and donate!

Your generosity helps pay for the ongoing costs associated with running this website like coffee, hosting services, library mirrors, domain renewals, time for article research, and coffee, just to name a few.



2 thoughts on “Check WordPress Core files integrity”

  1. oops ziet er niet goed uit vrees ik ? HELP! Checksum for ./wp-content/themes/twentyseventeen/footer.php does not match!

    Reply

Hi! Join the discussion, leave a reply!

%d bloggers like this: