Checksum

A checksum is a short string worked out from the contents of a file. The working out is done by a hash function, which takes input of any length and gives back output of a fixed length. An MD5 checksum is always 32 characters. The same contents always give the same string, and different contents should, as far as possible, give different ones.

That makes a checksum a quick answer to one question: is this file the one its publisher released? Compare the file's checksum with the one the publisher lists, and you know without reading the file.

Where you meet it

• Beside every download of WordPress. The release archive on WordPress.org has an md5 and a sha1 link next to each file. Each holds the checksum of that download.
• Inside WordPress's updater. WordPress.org also publishes a checksum for every single file in a release. WordPress fetches that list itself when it updates.
• In WP-CLI. wp core verify-checksums downloads the list for your version and compares the installed files with it, without loading WordPress. wp plugin verify-checksums does the same for plugins, using the checksums WordPress.org holds for each plugin and version.

What goes wrong

• "It ended in Success" is read as clean. If a file has been added to WordPress's folders and no original was changed, the core command prints Warning: File should not exist: with the file's name, and its last line still says Success. Read every line.
• It is taken to cover the whole site. WP-CLI has no checksum command for themes. A plugin that did not come from WordPress.org is skipped with a warning. Nothing in wp-content/uploads or wp-content/mu-plugins is looked at, nor a drop-in, wp-config.php, .htaccess or the database. Those are places a planted redirect lives, and WordPress site redirecting to another site goes through each one.
• A failed checksum is read as proof of a hack. It is proof that the file differs from the original. Someone on your side may have edited it. Compare it with the same version downloaded again. How to check whether your WordPress site has been hacked puts checksums beside the other checks.
• A mismatch is fixed one file at a time. Replacing the files that failed leaves whatever the commands never looked at. Why your WordPress site keeps getting hacked rebuilds from clean downloads and then uses checksums to confirm the result.

How to look at yours

Run these from the site's main folder. They need SSH access and WP-CLI.

A clean run prints one line for each command and nothing else. The count is the number of plugins you have.

Anything else on the screen is a finding. --include-root also warns about files in the main folder that are not part of WordPress, and some of those will be yours. A plugin count followed by "(1 skipped)" means one plugin was not checked. The client site takeover checklist has a table of what each line of output means.