PHPackages                             eriktorsner/wp-checksum - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. eriktorsner/wp-checksum

ActiveWp-cli-package

eriktorsner/wp-checksum
=======================

Check plugin and theme consistency

0.3.0(9y ago)433.4k↓100%4[7 issues](https://github.com/eriktorsner/wp-checksum/issues)MITPHPPHP &gt;=5.3.9

Since Sep 18Pushed 9y ago7 watchersCompare

[ Source](https://github.com/eriktorsner/wp-checksum)[ Packagist](https://packagist.org/packages/eriktorsner/wp-checksum)[ Docs](https://github.com/eriktorsner/wp-checksum/)[ RSS](/packages/eriktorsner-wp-checksum/feed)WikiDiscussions master Synced today

READMEChangelogDependencies (1)Versions (9)Used By (0)

wp-checksum
===========

[](#wp-checksum)

[![Build Status](https://camo.githubusercontent.com/16aa8500f554402029e8f28dd38e236aafc32364ae8e6f6caf45f80607d5046e/68747470733a2f2f7472617669732d63692e6f72672f6572696b746f72736e65722f77702d636865636b73756d2e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/eriktorsner/wp-checksum)[![codecov](https://camo.githubusercontent.com/cb3c9f28e279d587511f7180cb88355a10e9c80869375c47ce6f09e79cfa8ea6/68747470733a2f2f636f6465636f762e696f2f67682f6572696b746f72736e65722f77702d636865636b73756d2f6272616e63682f6d61737465722f67726170682f62616467652e737667)](https://codecov.io/gh/eriktorsner/wp-checksum)[![license](https://camo.githubusercontent.com/2dd702cd5d2fb41041871e0a944e87d6aa949bf2fad17751587ddb1b4237728d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f6572696b746f72736e65722f77702d636865636b73756d2e737667)](https://opensource.org/licenses/MIT)

Wp-cli sub command for verifying checksum data for themes and plugins. It checks the md5 sum of all files inside each plugin and theme and compares against what the same plugin/theme looks like on the WordPress repo. The core wp-cli command has this functionality for core, this sub command brings the same for plugins and themes.

wp-checksum checks for added, removed or modified files and prints out info about files that does not match the original file as it exists in the .org repositories.

Backend api
-----------

[](#backend-api)

wp-checksum uses a backend API () to retreive the checksums for known plugins and themes from our database. It's also possible to run wp-checksum in local mode, In this case wp-checksum, downloads zip-files directly from the Wordpress.org repository and avoid using the API. There are several advantages of using the API over local mode:

- Performance
- Reliability
- WordPress.org does't keep zip-files available for all versions of all plugins, roughly 15% av all plugins are affected. The remote API can deliver checksum data for these plugins but that's not possible when running wp-checksum locally.
- The diff sub command currently only works with the remote API

Read more about how the api and hourly rate limits work in the section "Backend api and rate limits" below.

### Known issues

[](#known-issues)

- Does not ignore minor changes in a plugin/themes readme.txt file. This may lead to false positives
- A locally developed plugin or theme may trigger false positives if a plugin or theme in the official repository has the same name.
- Does not know how to verify premium plugins.
- Some plugins and themes does not have all historic versions available and therefore can't be checked (but who uses old plugin versions anyway?)
- Some plugins add files into it's own installation folder. This will trigger false positives

Installation
------------

[](#installation)

### Globally, as a wp-cli package

[](#globally-as-a-wp-cli-package)

```
wp package install eriktorsner/wp-checksum
```

### Via composer

[](#via-composer)

wp-checksum can also be installed manually or via compser.

```
$ composer require eriktorsner/wp-checksum
```

To activate wp-checksum when installed locally via composer, you need to edit (or create) your wp-cli.yml file to make sure it includes the vendor/autoload.php file.

```
require:
    - vendor/autoload.php
path: /path/to/my/wordpress/installation
```

Running wp-checksum
-------------------

[](#running-wp-checksum)

```
### SYNOPSIS

  wp checksum

### SUBCOMMANDS

  all           Verify integrity of plugins and themes by comparing file checksums
  plugin        Verify integrity of all plugins by comparing file checksums
  theme         Verify integrity of all themes by comparing file checksums
  diff          Diff a file in your local WordPress install with it's original
  apikey        Get or set the api key stored in WordPress options table
  quota         Print API rate limits for current api key
  register      Register email address for the current api key to increase hourly quota.

```

### Global options

[](#global-options)

- **--format** Optional. How to format the output. Table (default), json, csv or yaml
- **--apikey** Optional. Specify key to override the default key
- **--local** Optional. Run in local mode. Download zip files from wordpress.org for local extraction and comparision.
- **--localcache** Optional. Specify where wp-checksum keeps copies of downloaded zip files. Defaults to /tmp

### wp checksum all|theme|plugin

[](#wp-checksum-allthemeplugin)

The base functionality of wp-checksum. Verifies local checksum data for everything (all), all plugins (plugin) or all themes (theme). For the plugin and theme sub commands, you can optionally specify a slug to just verify a specific plugin or theme.

#### OPTIONS

[](#options)

- **slug** Optional. Name of a specific plugin or theme to check. Leave blank to check all installed
- **--format** Optional. How to format the output. Table (default), json, csv or yaml
- **--details** Optional. Set this flag to output details about all modified/added/deleted files
- **--apikey** Optional. Specify key to override the default key

### wp checksum diff &lt;type&gt; \[&lt;slug&gt;\] &lt;path&gt;

[](#wp-checksum-diff-type-slug-path)

Diff a file in your local WordPress install with it's original

#### OPTIONS

[](#options-1)

- **type** core, theme or plugin
- **slug** The slug to identify the plugin or theme. Skip this arg for core files
- **path** Path of the file to check, relative to the root of core or the theme or plugin

The diff command determines the local version of the object to compare and then retreives the corresponding original file. If both files are found, the two files are compared using the command diff. Output is colored so that new or changed lines in the local version are red.

### wp checksum quota

[](#wp-checksum-quota)

Displays the current api rate limit usage.

#### OPTIONS

[](#options-2)

- **--apikey** Optional. Specify key to override the default key

### wp checksum apikey &lt;action&gt; \[&lt;apikey&gt;\]

[](#wp-checksum-apikey-action-apikey)

Get or set the api key stored in the current WordPress installation.

#### OPTIONS

[](#options-3)

- **action** Mandatory. Get (print) or set (store) default key
- **apikey** Mandatory for action=set. Specify key to store as default key in WP options table

### wp checksum register &lt;email&gt;

[](#wp-checksum-register-email)

Connect your email address to the default (or specified via --apikey) key to raise your hourly api rate limit.

#### OPTIONS

[](#options-4)

- **email** Mandatory. Get (print) or set (store) default key

Examples
--------

[](#examples)

```
# Check themes and plugins, format output as table (default), use API
$ wp checksum all
```

```
# Check themes and plugins, use locally stored zipfiles in /tmp
$ wp checksum all --local
```

```
# Check themes and plugins, use locally stored zipfiles in /var/zipcache
$ wp checksum all --local --localcache=/var/zipcache
```

```
# Only check themes, format as json and include details
$ wp checksum theme --format=json --details
```

```
# Check a specific theme, format as yaml and include details
$ wp checksum theme twentysixteen --format=yaml --details
```

```
# Only check plugins, omit all output except the actual data table
$ wp checksum plugin --quiet
```

```
# Check a specific plugin
$ wp checksum plugin jetpack
```

```
# Diff a core file
$ wp checksum diff core wp-admin/about.php
```

```
# Diff a plugin file
$ wp checksum diff plugin hello-dolly hello.php
```

```
# Diff a theme file
$ wp checksum diff theme twentytwelve 404.php
```

```
# Check the current API rate limit for the current api key
$ wp checksum quota
```

```
# Check the current API rate limit for a specific api key
$ wp checksum quota --apikey=ABC123
```

```
# Register email address to trigger validation email
$ wp checksum register me@example.com
```

```
# See the default api key
$ wp checksum apikey get
```

```
# Set a new default api key
$ wp checksum apikey set ABC123
```

Output
------

[](#output)

By default, wp-checksum will output a table with information with the number of changes detected printed out;

In this example, there are two premium plugins and two plugins from the repository. The premium plugins can't be checked. One of the checked plugins has issues, the other one is fine:

```
$ wp checksum plugin --quiet
+--------+-----------------------------------+-----------+---------+------------------+--------+
| Type   | Slug                              | Status    | Version | Result           | Issues |
+--------+-----------------------------------+-----------+---------+------------------+--------+
| plugin | homepage-control                  | Checked   | 2.0.2   | Changes detected | 2      |
| plugin | storefront-designer               | Unchecked | 1.8.4   |                  |        |
| plugin | storefront-woocommerce-customiser | Unchecked | 1.9.1   |                  |        |
| plugin | wp-cfm                            | Checked   | 1.4.5   | Ok               | 0      |
+--------+-----------------------------------+-----------+---------+------------------+--------+
```

To get more details, the --details switch can be used:

```
$ wp checksum plugin --quiet --details
+--------+-----------------------------------+-----------+---------+------------------+----------------------------------------------------+
| Type   | Slug                              | Status    | Version | Result           | Issues                                             |
+--------+-----------------------------------+-----------+---------+------------------+----------------------------------------------------+
| plugin | homepage-control                  | Checked   | 2.0.2   | Changes detected | {"index.php":"MODIFIED","warez_virus.php":"ADDED"} |
| plugin | storefront-designer               | Unchecked | 1.8.4   |                  |                                                    |
| plugin | storefront-woocommerce-customiser | Unchecked | 1.9.1   |                  |                                                    |
| plugin | wp-cfm                            | Checked   | 1.4.5   | Ok               |                                                    |
+--------+-----------------------------------+-----------+---------+------------------+----------------------------------------------------+
```

Naturally, getting detailed output makes a whole lot more sense when using yaml, or json:

```
[{
	"Type": "plugin",
	"Slug": "homepage-control",
	"Status": "Checked",
	"Version": "2.0.2",
	"Result": "Changes detected",
	"Issues": {
		"index.php": "MODIFIED",
		"warez_virus.php": "ADDED"
	}
}, {
	"Type": "plugin",
	"Slug": "storefront-designer",
	"Status": "Unchecked",
	"Version": "1.8.4",
	"Result": null,
	"Issues": null
}, {
	"Type": "plugin",
	"Slug": "storefront-woocommerce-customiser",
	"Status": "Unchecked",
	"Version": "1.9.1",
	"Result": null,
	"Issues": null
}, {
	"Type": "plugin",
	"Slug": "wp-cfm",
	"Status": "Checked",
	"Version": "1.4.5",
	"Result": "Ok",
	"Issues": null
}]
```

Parameters in wp-cli.yml
------------------------

[](#parameters-in-wp-cliyml)

Default values for parameters **apikey**, **details**, **local**, **localcache** and **format** can be entered into the wp-cli.yml file. Add a section named checksum:

```
checksum:
  details: yes
  format: json
  apikey: ABC123
  local: yes
  localcache: /var/zipcache
```

Specifying the api key
----------------------

[](#specifying-the-api-key)

The api key can be specified in multiple ways. wp-checksum will try to locate an api key in the following order:

1. Passed in via the --apikey command line parameter
2. Specified in the wp-cli.yml file
3. Specified in the environment variable WP\_CHKSM\_APIKEY
4. Found in the options table in the current WordPress installation

If no api key is found in any of the above locations, wp-checksum will attempt to create an anonymous api key and store it in the WordPres options table. Creating an anonymous api key might fail if too many new keys are generated at the same time from the same source IP address.

Backend api and hourly rate limits
----------------------------------

[](#backend-api-and-hourly-rate-limits)

The backed api and database are work in progress and requires a fair amount of work. In order to minimize various kinds of abuse, the api has an hourly rate limit. The first time you use wp-checksum, an anonymous api key is generated and stored in the WordPress options table. The anonymous key grants up 30 requests api per hour (subject to change). If you register and validate your email address, your hourly limit is raised to 100 requests per hour (subject to change). If you need to go beyond 100 requests per hour, you are welcome to subscribe to the service and paying a (small) montly fee. If you do that, also know that you are supporting a project that I think can do a lot of good for the WordPress community. Thanks in advance.

Please go to  to subscribe to a paid api key.

I've previously announced a plan to release the code for the backend api as open source. While I havent completely abandoned that plan it's not going to be a high priority in the short term (2017). The main reasons is that the backend API has grown a lot more complex that it initially was and it's simply not feasable to maintain that service and support other users as well.

Change log
----------

[](#change-log)

### Version 0.3.0

[](#version-030)

New sub command diff. Unit tests added, 97% coverage.

### Version 0.2.0

[](#version-020)

Changed default behaviour. The naked command "wp checksum" previously was a short for for sub command "wp checksum all". Now the naked command just displays usage information.

###  Health Score

31

—

LowBetter than 71% of packages

Maintenance17

Infrequent updates — may be unmaintained

Popularity30

Limited adoption so far

Community14

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 98.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~16 days

Total

8

Last Release

3354d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/03c44b3a07e257cc3a9ef1db7960e470db98bc41d03f99073b37443ddf7f33f7?d=identicon)[eriktorsner](/maintainers/eriktorsner)

---

Top Contributors

[![eriktorsner](https://avatars.githubusercontent.com/u/2832047?v=4)](https://github.com/eriktorsner "eriktorsner (81 commits)")[![danielbachhuber](https://avatars.githubusercontent.com/u/36432?v=4)](https://github.com/danielbachhuber "danielbachhuber (1 commits)")

---

Tags

wordpress

### Embed Badge

![Health badge](/badges/eriktorsner-wp-checksum/health.svg)

```
[![Health](https://phpackages.com/badges/eriktorsner-wp-checksum/health.svg)](https://phpackages.com/packages/eriktorsner-wp-checksum)
```

###  Alternatives

[rarst/laps

Light WordPress profiler.

566257.9k2](/packages/rarst-laps)[htmlburger/wpemerge

A micro framework which modernizes WordPress as a CMS development by providing tools to implement MVC and more.

457136.8k8](/packages/htmlburger-wpemerge)[cedaro/satispress

Generate a Composer repository from installed WordPress plugins and themes.

55633.7k](/packages/cedaro-satispress)[rarst/wps

WordPress plugin for whoops error handler.

129132.3k3](/packages/rarst-wps)[rarst/fragment-cache

WordPress plugin for partial and async caching of heavy front-end elements.

14214.8k2](/packages/rarst-fragment-cache)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)
