# CoreFiles
> The original files of every Joomla and WordPress release, run by mySites.guru. Free, no API key, read-only GET requests.
Use it to tell whether a file on a Joomla or WordPress site is an unmodified core file, which release it came from, and what changed between releases. Hash the site's files where they are and send only the hashes; never upload a site's files.
Base URL: https://corefiles.mysites.guru
Platforms: joomla, wordpress. Versions as released, for example 5.4.0, 6.2.0-rc1, 7.1.4.
Add ?format=json to a page URL (/lookup, /pretty, /folder, /history, /diff, /stats) for the same data as JSON.
## Look up a file by its hash
GET /lookup/{md5 or sha256}?format=json&name={file name}
Lists every release and path that has this content. No matches means it is not a core file in any stored release. With name, "named" lists core files that have that file name, so you can fetch the original and compare.
## Read a core file
GET /raw/{platform}/{version}/{path} the file's bytes
GET /stat/{platform}/{version}/{path} md5, sha1, sha256 and size as JSON
GET /history/{platform}/{path}?format=json the releases where that file changed
## Compare releases
GET /diff/{platform}/{from}/{to}?format=json added, removed and changed files
GET /diff/{platform}/{from}/{to}/{path}?format=text a unified diff of one file
## Check a whole site
GET /hashes/{platform}/{version}/plain
Every core file in that release as path<TAB>md5. Hash the site's files and compare: a different md5 means a modified core file, and a file missing from the list is not core.
## Reading the answers
A 404 with X-Corefiles-Release: present means the path is not in that release, so the file is not core.
A 404 with X-Corefiles-Release: missing means that release is not stored yet. Treat the answer as unknown, never as "not core". New releases are added within the hour.
GET /releases.json lists every stored release.
Paste it into Claude, ChatGPT or Cursor. Agents can also read it at /llms.txt. On a lookup, file, history or compare page, Copy for your AI agent adds what that page shows.
Stats
2,040 releases, every file in them, and how much disk that takes once each file is stored only once.
Zips against what is storedSame scale on both rows. Each file is kept once, however many releases contain it
WordPress
1,439 releases
1.15 GB stored: 83,905 unique files out of 2,522,88816.61 GB as zips
Joomla
601 releases
1.11 GB stored: 201,615 unique files out of 4,402,07711.47 GB as zips
All together: 2.26 GB on disk for 28.08 GB of zips, 8%. A new release adds only the files it changed. Each zip's name, size, sha256, md5 and sha1 are kept in releases.json.
HealthRead from the store on every refresh
Check
State
Detail
Last ingestOK15 Nov 2026 18:38 UTC, 0 new, 0 failed
Upstream lagUnknownNo upstream check has run yet
Last verifyOK284,703 blobs re-hashed 14 Nov 2026 16:35 UTC, no findings
Hash listsOKEvery hash list agrees with its zip
Waiting to fetchNoneAsked-for versions are fetched within a minute
Off-site copyOKCloudflare R2, 15 Nov 2026 03:52 UTC, 284,731 files