Check WordPress Core files integrity

Check the md5 checksum of WordPress Core files against WordPress’ checksums API, using this standalone PHP file. I chose to use a standalone PHP script to check the md5sum of WordPress Core files against the API so you’re not dependent on a possibly hacked WordPress installation. This kind of guarantees the result can be trusted, as opposed to using a WordPress plugin. I think this is a better integrity check of WordPress Core files.

What do you think of this approach? Let me know through the comments, thanks!

Because it is a standalone PHP script, and not part of WordPress ecosystem, you need to include wp-includes/version.php. Otherwise you are not able to use the $wp_version and $wp_locale variables which are required.

Copy and paste the following code into a new file and upload the file to your WordPress root folder.

<?php
/**
 * Verify WP Core files md5 checksums, outside WordPress.
 * Use this script to verify md5 checksums of WordPress core files.
 * 
 * Follow me on Twitter: @HertogJanR
 * Please donate: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=J24FGGU96YSUY
 */

if ( version_compare( PHP_VERSION, '5.6.29', '<' ) ) {
    die( 'You are using PHP Version: ' . PHP_VERSION . '.
        I think you should use a higher PHP version, at least 5.6.29!
        (change the PHP version check if you must...) ' );
}

/**
 * Put this file in the your WordPress root folder, leave ABSPATH
 * defined  as './'.
 */
define('ABSPATH', './');
if ( defined( 'ABSPATH' ) ) {
    include( ABSPATH . 'wp-includes/version.php' );
    $wp_locale = isset( $wp_local_package ) ? $wp_local_package : 'en_US';
    $apiurl = 'https://api.wordpress.org/core/checksums/1.0/?version=' . $wp_version . '&locale=' .  $wp_locale;
    $json = json_decode ( file_get_contents ( $apiurl ) );
    $checksums = $json->checksums;

    foreach( $checksums as $file => $checksum ) {
        $file_path = ABSPATH . $file;

        if ( file_exists( $file_path ) ) {
            if ( md5_file ($file_path) !== $checksum ) {
                // do something when a checksum doesn't match
                echo "HELP! Checksum for " .$file_path ." does not match!";
            }
        }
    }
}
?>

Now run the file in your browser. No result means everything is OK.

I thought you might find this interesting:   Add a delay to your WordPress login form

Searching for backdoors in PHP files #

When going through a hacked WordPress searching for backdoors, there is not really an advantage in verifying core files checksums first. One might say you don’t have to scan files which checksums match, but in my opinion you just have to scan everything.

So if you found this article interesting, you may also like my post using grep to search for backdoors. The post contains a lot of useful grep examples and information, use it wisely.


Please Support Saotn.org

Each post on Sysadmins of the North takes a significant amount of time to research, write, and edit. Therefore, your donation helps a lot! For example, a donation of $3 U.S. buys me a cup of coffee, and as you know: things jsut work better with coffee. A $10 U.S. donation buys me one month of web hosting (yes, hosting costs money). But seriously, thank you for any amount. Much appreciated!

Please donate to support this site if you found a post interesting or if it helped you solve a problem. Thanks! (Tip: no Paypal account required)

If you appreciated this post, then please donate using this Paypal button


Jan Reilink

My name is Jan. I am not a hacker, coder, developer, programmer or guru. I am merely a system administrator, doing my daily thing at Vevida in the Netherlands. With over 15 years of experience, my specialties include Windows Server, IIS, Linux (CentOS, Debian), security, PHP, websites & optimization.

Leave a Reply

2 Comments on "Check WordPress Core files integrity"

Hi! Join the discussion, leave a reply!

Sort by:   newest | oldest | most voted
jules
Guest

oops ziet er niet goed uit vrees ik ? HELP! Checksum for ./wp-content/themes/twentyseventeen/footer.php does not match!