Drupal core file integrity checks, Composer projects included
Drupal publishes no list of hashes for its files. We compute them from the official archive of each version and compare them with the site, whether you installed it from the archive or with Composer.
With Composer, core files differ from the archive.
Composer installs core from git: the .info.yml files lack the lines drupal.org adds to its archives. On Drupal 10.6 that is 626 files. A naive comparison flags them all as modified.
Sites installed from the archive also keep vendor/ inside the site folder, with thousands of library files to check.
Hashes from the official archive, in both forms.
drupal.org archive
We download the archive of the installed version from ftp.drupal.org, the same source Composer uses for modules.
Two accepted forms
For
.info.ymlfiles only, we accept the archive version and the git version, obtained by removing exactly the block drupal.org adds.Extra files
We look for files that are not part of the release inside
core/and, for archives, insidevendor/.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
What if I patch core with Composer?
The file shows as modified, next to the original. If the patch is intended, you approve it.
And after a core update?
We compare files with the archive of the new version. In our real updates from 8.9 to 11.4 the core always came out clean, with a single update notification.
Goes well with
- Alerts for Drupal core and modules on insecure releasesdrupal.org data: insecure releases and the version that fixes them.
- Detecting Drupalgeddon and Drupalgeddon2 backdoors on Drupal sitesDatabase backdoors, PHP in public files, miners in core: the traces of both attacks.
- Drupal site monitoring for web agenciesA native Drupal module, with insecure releases and core integrity from drupal.org.
- Encrypted backups and restores for Drupal sitesDatabase and files encrypted on the site, restores that keep the site connected.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.