Check core files against wordpress.org
Whether a file of the WordPress core has been altered can be established objectively: wordpress.org publishes a list of checksums for every version. It is exactly this list that the File integrity area loads and compares with the files on your server via the MD5 sum. Deviations are reported separately by kind.
Where the comparison values come from
The checksum interface of api.wordpress.org is queried, using the exact version and language of this installation — there is no local stock. If no list is available for the language, the plugin repeats the query with en_US. If no valid answer comes back, the run stops with a message instead of reporting a result.
https://api.wordpress.org/core/checksums/1.0/Start the check
- In “Kakapo Security”, click “File integrity” (in German: „Datei-Integrität“) on the left in the “Scanner” group.
- In the “Core check” card, click “Check core now”.
- Wait for the message; it gives the number of files checked as well as the changed, missing and unknown hits. The page then reloads.
- Read the “Last checked” row — it gives the time in UTC as well as the version and the language.
- Below the four key figures are the lists of the affected files; they only appear if there are hits.
The three kinds of findings
- Changed: the file is present, but its MD5 sum differs from the list.
- Missing: a file from the checksum list is not present on the server.
- Unknown: a PHP file in wp-admin or wp-includes that does not appear in the list at all.
- Files below wp-content are left out — they are not part of the core checksums and change as a matter of course.
- Each of the three lists shows at most 200 entries.
Besides being started at the push of a button, the core check runs once a day via WP-Cron. If it finds changed or unknown files, an email goes out, provided the “Notify on changed core file” switch is active under “Notifications” (in German: „Benachrichtigungen“).
Was this article helpful?