Weave Code
Checksum Command Laravel Package
wp-cli/checksum-command
Verifies WordPress file integrity by comparing installed files against WordPress.org's published checksums. Use wp core verify-checksums to detect tampered or missing core files, with options for version, locale, exclusions, and output formats.
wp-cli/checksum-command verifies the integrity of a WordPress installation by comparing its files against the official MD5 checksums published on WordPress.org. It downloads the checksums for the installed (or specified) version and locale, then reports any modified, missing, or unexpected files—without loading WordPress itself, keeping verification fast and safe.
- Adds the
wp core verify-checksumscommand to WP-CLI - Supports
--versionand--localefor accurate checksum matching --include-rootaudits the entire root directory for non-WordPress files--excludeskips specific files;--insecureretries failed downloads without TLS- Output as plain, table, json, csv, yaml, or count
Frequently asked questions about Checksum Command
- How do I install wp-cli/checksum-command for a Laravel project?
- Install it with Composer as wp-cli/checksum-command, typically alongside the wp-cli/wp-cli runtime, or let WP-CLI pull it in via its package manager. Because it is a WP-CLI command package rather than a Laravel package, it will not register a service provider or facade. You then invoke it through the wp binary, for example wp core verify-checksums, usually from a shell, a queue job, or a scheduled Artisan command that shells out.
- Can I use wp-cli/checksum-command without loading WordPress in a Laravel app?
- Yes, avoiding a WordPress bootstrap is a core design goal of the command. It downloads md5 checksums from WordPress.org and compares them against the installed files directly, so it does not need WordPress to be loaded to verify integrity. In a hybrid Laravel and WordPress deployment you can point the command at the WordPress root path and run verification inside your Laravel tooling without booting the CMS.
- Which PHP and Laravel versions does this package support?
- The package is a WP-CLI command, so its real compatibility surface is WP-CLI and PHP rather than a specific Laravel release. The 3.x line implies a WP-CLI 3.x-era runtime, and PHP 8.0 and above is the working assumption for Laravel 8 and newer, but this should be confirmed against the 3.x composer.json before adoption. There is no Laravel framework constraint because there is no Laravel integration code inside the package.
- How do I verify checksums for a specific WordPress version or locale?
- Pass the --version and --locale options to wp core verify-checksums, for example wp core verify-checksums --version=6.4 --locale=en_US. The values should match what the site reports under Dashboard, Updates, otherwise the downloaded checksums will not correspond to the installed files. If verification fails unexpectedly, mismatched version or locale arguments are the most common cause.
- How do I exclude Laravel or non-WordPress files from checksum verification?
- Use the --exclude option with a comma-separated list of file paths relative to the WordPress root. This is useful when a shared root contains Laravel artefacts such as storage, bootstrap/cache, or vendor directories that are not part of core. The exclusion behaviour was refined in 2.3.7 and is retained in 3.x, but it has not been extended, so complex glob patterns may need to be handled in your own wrapper code.
- Is the 3.0 major version bump a breaking change for existing setups?
- Treat it as one until proven otherwise, because SemVer major releases are a breaking-change gate even when the published release notes look small. The only functional change highlighted is parallel plugin checksum downloads, with the rest being PHPCS and PHPStan hygiene. Pin ^2.3 in production while you run a spike against 3.0.1, and review the full 3.0.0 changelog rather than just the patch notes.
- How do I parse checksum verification output into Laravel collections?
- Pass --format=json or --format=csv and decode the command output in Laravel, for example with collect(json_decode($output, true)). The command also supports plain, table, yaml, and count formats for simpler reporting. There is no native Laravel HTTP client integration or collection mapping, so wrapping the parsing in a dedicated service class keeps things testable and avoids scattering shell-exec handling through your codebase.
- Can I run checksum verification inside CI, and what about parallel plugin downloads?
- Yes, this is a common use case for hybrid Laravel and WordPress repositories, but you need WP-CLI available in the container. Version 3.0 introduced parallel plugin checksum downloads, which speeds up environments with many plugins but means multiple concurrent outbound requests to WordPress.org, introducing throttling, timeout, and partial-result failure modes that did not exist in 2.x. Add retries and backoff, cap concurrency where possible, and cache checksum responses between runs.
- Is the --insecure flag safe to use in production?
- No. The --insecure option retries downloads without certificate validation when a TLS handshake fails, which exposes the request to man-in-the-middle attacks and can undermine the integrity check you are performing. Use it only as a last resort during debugging, and prefer fixing the certificate chain or CA bundle in the runtime. In automated pipelines, disable or block the flag at the wrapper level.
- Is wp-cli/checksum-command actively maintained, and what are the alternatives?
- The repository shows ongoing maintenance through PHPCS and PHPStan fixes, parallel download work, and CI test and coverage badges, so upstream hygiene is being kept up. Alternatives include writing your own checksum comparison against the WordPress.org checksum API, or using managed hosting integrity tools. For Laravel teams, the package remains the most direct way to detect modified or missing WordPress core files without booting WordPress.
Weaver
How can I help you explore Laravel packages today?