DiffVerity – File Integrity & Source Diff

DiffVerity is a focused, read-only integrity investigation tool. It answers what changed, where it changed, what comparison source was used, and whether that source is independently authoritative.

It does not claim that a changed file is malware, and it does not claim that an unchanged installation is secure. File differences can result from legitimate customization, deployment tooling, an incomplete update, unintended modification, or compromise.

Features

• Verifies WordPress core against checksums for the exact installed version and locale.
• Verifies eligible WordPress.org plugins against exact-version checksums.
• Compares WordPress.org themes with exact-version official packages.
• Supports explicit, hash-only Local Baselines for private, premium, and custom plugins/themes.
• Separates Officially Verified, Official Source Available, Official Core Bundle, Local Baseline, No Trusted Source, and Not Verifiable states.
• Recognizes current and recent official plugin/theme copies bundled with WordPress, including older wp-content variants legitimately preserved during core updates.
• Detects verified, modified, missing, unexpected, baseline-added, baseline-missing, and skipped files.
• Identifies line-ending and UTF-8 BOM-only changes as Soft Differences while retaining the raw mismatch.
• Shows escaped, human-readable source diffs for eligible text files.
• Shows hashes and sizes instead of attempting line diffs for binaries or large files.
• Runs on demand in resumable, resource-bounded admin batches with cancellation and scan locking.
• Scans all components or one selected WordPress core, plugin, or theme component.
• Stores capped scan history and baseline history in dedicated, indexed tables.
• Exports JSON, CSV, and text reports without full source code or absolute server paths.
• Adds no frontend assets, telemetry, analytics, tracking, firewall, automated repair, or malware claims.

Trust sources

Officially Verified means the installed file was compared with an authoritative checksum for the exact installed version.

Official Source Available means DiffVerity retrieved an authoritative exact-version WordPress.org package and generated a comparison manifest.

Official Core Bundle means the file matches a checksum from a current or recent official WordPress distribution. WordPress can change default-theme metadata or bundled plugin code without changing the component’s own version, and core updates preserve existing wp-content files. DiffVerity records the originating WordPress bundle version for exact evidence and diffs.

Local Baseline means an administrator deliberately recorded local SHA-256 hashes. Local baselines prove that files changed after the baseline was created. They do not prove that the baseline itself was clean or authentic.

No Trusted Source means no independent comparison source could be established. This is not itself a security warning.

Not Verifiable describes a source that could not be checked, for example because of a network or malformed-response failure.

External services

DiffVerity contacts WordPress.org only when an administrator runs a scan or requests an exact source diff.

• api.wordpress.org is used to request checksums for the installed WordPress version/locale and, only when a bundled component header matches neither the component package nor the current bundle, a bounded newest-to-oldest set of recent WordPress minor releases.
• downloads.wordpress.org/plugin-checksums/ is used to request eligible plugin checksums for the exact installed slug and version.
• downloads.wordpress.org/plugins/, downloads.wordpress.org/theme/, and downloads.wordpress.org/release/ are used to retrieve exact-version packages when package comparison or original-line display is needed.
• core.svn.wordpress.org is used only for an administrator-requested diff of a core-bundled plugin/theme file. DiffVerity retrieves that one file from the recorded WordPress tag instead of downloading the complete WordPress release archive.

Requests send the component slug/version or WordPress version/locale, a DiffVerity user-agent, and the site URL included in that user-agent. DiffVerity does not send local source code, database content, customer information, admin usernames, or site content. Requests use HTTPS with certificate verification. Redirects to unrelated hosts are not followed.

Checksum-verified single-file source responses are cached under the server’s private temporary directory for up to six hours to make repeated diff actions fast. Cache filenames are hashes, cached files use a non-executable .source extension and restrictive permissions, and stale entries are removed automatically.

WordPress.org privacy policy: https://wordpress.org/about/privacy/

Privacy

DiffVerity includes no telemetry, analytics, tracking, advertising, marketing requests, or vendor cloud API. Its only external communication is the documented, administrator-triggered authoritative WordPress.org lookup described above.

Limitations

File integrity does not measure overall website security. An official package can still contain a software vulnerability, and compromise can exist in the database, uploads, server configuration, or another unscanned location. DiffVerity does not make malware-free, clean, authentic, or overall-security guarantees.

Local Baselines retain hashes and metadata rather than full source copies, so original-line diffs are unavailable for baseline-only changes.

DiffVerity does not repair or delete files. It deliberately keeps investigation separate from remediation because changed files may be legitimate local additions or customizations.