In order to compare our checksums versus your files, you’ll need to have SSH access to your WordPress files.
Once logged in via SSH, use the cd utility to navigate to the documentroot of your WordPress site. This is usually somewhere like /home/user/www , or /var/www/html, although this can vary. Check with your web host if you’re not sure where this is.
cd /path/to/wordpress
You’ll need to know the version of WordPress you have installed. There are a few ways to determine this.
- If logged into your wp-admin panel, you can look atthe very bottom-left corner to see the version
- You can use wp-cli to get the version:
wp core version - You can get the version from the version.php file with grep:
grep '$wp_version =' wp-includes/version.php
Once you know the version, get the checksums for it. For example, to get the checksums for WordPress 5.3.2 from this url:
https://wpmd5.mattjung.net/core/5.3.2/
Now finally, to pull it all together, use curl to retrieve our md5sum list, and the md5sum command to compare our checksums against the checksums of your WordPress Core files:
curl -s https://wpmd5.mattjung.net/core/5.3.2/ |md5sum -c --quiet -
If the command returns no output, that means all of your files matched up exactly against the known checksums, which is good. If there is output, that will mean there was at least one file that didn’t match, which should be looked into if the file wasn’t intentionally edited.