Published by
Every file of every published release, fingerprinted with MD5 and SHA-256. Check whether the plugin files on a site are the files we shipped — no account, no license key, no request that identifies the site being checked.
Coverage starts 14 Aug 2026. We publish checksums from the current release of each product forward, not for versions released before this service existed. If a version is not listed, we have no manifest for it — that is a gap in our coverage, not a finding about the files.
b4649f1ec4371baadf9a63dac25c03a616d846e4945769e97c1b42cbf9613020
4f42d98b5311cac630df6a4318a52bc03e08b22fddb165ba4b22c822d7d6c0e8
21520209ef461e7c9bc8d73539b245fdddc610f7e650f3d600f9b0ea0b2f5385
b4ba9196d62e5b59bf12f592b58c48224903bd3aa7de585557f4a7bbc96142c3
085358412bf1cd474fb80a210dd2db4f4f23a16b2b7381ec0424707fa36a08cd
16ce5e23a43242990f3ab4714edffa3d0aa9be617a32bf00b04530a56429cd79
d91eee701ff0d80a960e9290d1e86c8b1f0feb417541c738168bb152f887fc22
893650168cc88929bdb0feb82e3808245aeb315a8a3acc62a0ca266302143cea
854b7cc7003fe11921295488f8ad3d8ba7900917e73c4c882f4f17983416ab7b
3f7ca9730e1fff1ee56f45dd0342101136a3e2d0ab1b390e945b126f34e0c461
866b047dd316f0660841bf8ec40d7598718ead4b0f3a5bd66e95a61cf976c01f
fb7c20bb9d275eace2a335ae15207a71d95d650621b416efc805ca368abba19b
f77b11f7afddbe58adf9ab21656ba881ddf9e7ba00e6884b6a8a7c4ce4ab052b
5148c6180c9a8c1d7e9d4bdb758c559c2e533f7aef3c08319edf7bbd368aeaa0
No product matches that.
Hash the zip you received and compare it to the digest listed above. This tells you the archive is ours before you unpack anything.
$ shasum -a 256 azonpress.zip
b4649f1ec4371baadf9a63dac25c03a616d846e4945769e97c1b42cbf9613020 azonpress.zipCompare the whole string. A matching prefix means nothing on its own.
Fetch the manifest for the version on the site and compare every file. The manifest lists
paths relative to the plugin directory, so demo-pro.php means
wp-content/plugins/demo-pro/demo-pro.php.
# every file in one released version
curl https://checksums.wpmanageninja.com/plugin-checksums/{slug}/{version}.json
# which versions exist
curl https://checksums.wpmanageninja.com/plugin-checksums/{slug}/index.json
# everything we publish
curl https://checksums.wpmanageninja.com/plugins.json| Path | Returns |
|---|---|
/plugin-checksums/{slug}/{version}.json | Checksums for one release |
/plugin-checksums/1.0/?slug=…&version=… | The same, query-string form |
/plugin-checksums/{slug}/index.json | Every published version of one plugin |
/plugins.json | Every plugin listed above |
GET and HEAD only, CORS open, ETag honoured. A published
version never changes, so it is served immutable and can be cached forever.
The plugin, version and files keys are byte-compatible
with the WordPress.org checksum API, so anything that already reads
downloads.wordpress.org/plugin-checksums/ reads this too. Our additions live
under _meta, where strict consumers can ignore them.
{
"plugin": "example-pro",
"version": "1.4.2",
"files": {
"example-pro.php": { "md5": "…", "sha256": "…" }
},
"_meta": {
"zipSha256": "…", // the digest listed above
"fileCount": 412,
"softChange": [ … ], // may differ without meaning tampering
"ignore": [ … ] // written after install; skip these
}
}A mismatch means a file differs from what we published. That is worth investigating, but it is not proof of compromise on its own: FTP transfers in text mode rewrite line endings, and site owners sometimes patch plugins deliberately.
A clean result is narrower than it looks. It says the plugin directory matches our release. It says nothing about the rest of the site, and nothing about whether the release itself was safe. These manifests are served over TLS but are not yet signed, so they carry the same trust model as the WordPress.org checksum API.