Akeeba Panopticon

Public CMS Core Files Checksums API

What is this?

We offer MD5, SHA-1, SHA-256, and SHA-512 checksums for the core files included in all published versions of Joomla!® and WordPress®. These are used by Akeeba Panopticon to verify the integrity of your installation, but they can also be used by anyone else.

Accessing the Checksums

The endpoint URL for the checksums is https://getpanopticon.com/checksums/cms/version/checksum_type.json.gz

The cms parameter is either joomla (for Joomla!®) or wordpress (for WordPress®).

The version parameter is the CMS version, e.g. 5.0.0.

The checksum_type is one of md5, sha1, sha256, sha512, md5_squash, sha1_squash, sha256_squash, or sha512_squash. The *_squash versions have the corresponding checksum of the “squashed” version of the file. You can get the squashed version of a file using this function:

$squashed = preg_replace('#[\n\r\t\s\v]+#ms', ' ', $contents);

“Squashing” the contents of a PHP or JavaScript file ensures that the checksum will not change when a safe change takes place on the file: conversion between UNIX (LF) and Windows (CRLF) line endings, conversion between tabs and spaces, added/removed whitespace, added/removed blank lines.

If the cms, version, or checksum type you are looking for does not exist you will receive an HTTP 404 Not Found response.

The returned file is a GZip–encoded JSON file. You can convert its contents to a PHP array with:

$array = json_decode(gzdecode($fileContents), true);

The result is a string-indexed array where the key is the filename relative to the site's root, and the value is the checksum.

Only PHP, JavaScript, and INI files are included in the checksum results.

Download URLs

The endpoint https://getpanopticon.com/checksums/sources.json.gz serves a GZip-compressed JSON file with the download URLs of every Joomla!® and WordPress® version published to date. The format is as follows:

[
  {
    "cms":"joomla",
    "version":"1.0.0",
    "url":"https:\/\/downloads.joomla.org\/cms\/joomla10\/1-0-0\/joomla_1-0-0-stable-tar-gz?format=gz"
  },
  {
    "cms":"wordpress",
    "version":"6.5.0",
    "url":"https:\/\/wordpress.org\/wordpress-6.5.zip"
  },
  ⋮
]

Check the value of the cms key to distinguish between Joomla!® and WordPress® entries.

Accuracy, and update frequency

For Joomla!®, the point-of-truth used to derive the download URLs is downloads.joomla.org. For WordPress®, it is the WordPress.org stable releases API at api.wordpress.org. The official full installer ZIP files listed for each version are used as the point-of-truth to derive the list of files and their checksums.

The information is updated approximately once per hour on our server. Our server is behind CloudFlare CDN, which adds another delay of up to one hour when serving data. Therefore, new releases may not appear on our endpoint for up to two hours.

No guarantees are made for the accuracy of the information provided by this endpoint beyond our assurance that they reflect the data provided by the official CMS source, as seen by our server at the time the information was processed.

Reproducible, auditable content

We believe in radical transparency. We hate black boxes.

The source code of the application used to generate the checksums is publicly available under the GNU Affero General Public License, version 3 or the license or, at your option, any later version.

Please note that the initial run of that application takes several hours and consumes a significant amount of bandwidth (around 7GiB in October 2023, when it was first released).

Legal notice

This site is not affiliated with or endorsed by the Joomla! Project. It is not supported or warranted by the Joomla! Project or Open Source Matters. The Joomla!® logo is used under a limited license granted by Open Source Matters, the trademark holder in the United States and other countries.

This site is not affiliated with or endorsed by WordPress Foundation or Automattic. WordPress® is a registered trademark of WordPress Foundation.