MultiCmsManager
EN
Get early access

Drupal core integrity

Drupal core file integrity checks, Composer projects included

Drupal publishes no list of hashes for its files. We compute them from the official archive of each version and compare them with the site, whether you installed it from the archive or with Composer.

Get early access How it works

The problem

With Composer, core files differ from the archive.

Composer installs core from git: the .info.yml files lack the lines drupal.org adds to its archives. On Drupal 10.6 that is 626 files. A naive comparison flags them all as modified.

Sites installed from the archive also keep vendor/ inside the site folder, with thousands of library files to check.

How it works

Hashes from the official archive, in both forms.

  1. 1

    drupal.org archive

    We download the archive of the installed version from ftp.drupal.org, the same source Composer uses for modules.

  2. 2

    Two accepted forms

    For .info.yml files only, we accept the archive version and the git version, obtained by removing exactly the block drupal.org adds.

  3. 3

    Extra files

    We look for files that are not part of the release inside core/ and, for archives, inside vendor/.

In detail

What it covers.

  • Drupal 7 (the includes, misc, modules, themes and scripts folders) and 8.9 to 11
  • In our tests: zero false positives across 22,269 files of Drupal 10.6 installed from the archive
  • A modified core PHP file, .module and .install included, is a critical alert
  • settings.php, contributed modules and uploaded files stay out of the comparison
  • You can approve an intended change: the alert comes back only if the file changes again

FAQ

Frequently asked questions

What if I patch core with Composer?

The file shows as modified, next to the original. If the patch is intended, you approve it.

And after a core update?

We compare files with the archive of the new version. In our real updates from 8.9 to 11.4 the core always came out clean, with a single update notification.

Related features

Drupal Alerts for Drupal core and modules on insecure releases drupal.org data: insecure releases and the version that fixes them. Drupal Detecting Drupalgeddon and Drupalgeddon2 backdoors on Drupal sites Database backdoors, PHP in public files, miners in core: the traces of both attacks. Drupal Drupal site monitoring for web agencies A native Drupal module, with insecure releases and core integrity from drupal.org.

All features →

Try it on your clients' sites.

During the beta we let in a few agencies at a time and set up the first sites with you.

Get early access