Almost every WordPress compromise has one thing in common: a file changes. Malware has to be written to disk, a backdoor has to live somewhere, injected code has to modify something that already exists. File integrity monitoring is the discipline of noticing those changes — ideally within hours — instead of discovering them weeks later when Google blacklists the site. It is one of the most effective and least glamorous security controls you can run.
What file integrity monitoring is
File integrity monitoring (FIM) keeps a record of what your files are supposed to look like and checks the real files against that record on a schedule. When something is added, modified, or deleted that shouldn’t be, it alerts you. That’s the whole idea: instead of trying to recognise malware, it watches for unexpected change — and on a WordPress site, unexpected change in your code files is one of the strongest possible signals that something is wrong.
Why it fits WordPress so well
WordPress core, and the plugins and themes you install, are known quantities. A given version of WordPress ships exactly the same core files for everyone, and their official checksums are published. Your plugin and theme files shouldn’t change at all between updates. So when a core file is suddenly different, or a new PHP file appears in your uploads folder, or a theme file grew a block of obfuscated code overnight, there is no innocent explanation that looks like that — it is either an update you made or an intrusion. FIM turns that into an alert you can act on.
How it works
- A known-good baseline. The monitor establishes what “correct” means — for core files, the official WordPress.org hashes; for your plugins, themes, and custom files, a fingerprint of each file as it should be.
- Regular comparison. On a schedule, it re-fingerprints the live files and compares them to the baseline.
- Change alerts. Anything added, altered, or removed is flagged, with the specific file named, so you’re looking at facts rather than a vague “you may be infected”.
Integrity monitoring vs malware scanning
They answer different questions and work best together. A signature-based malware scan asks “does this file match something I already know is malicious?” Integrity monitoring asks “has this file changed from what it should be?” The second question catches the threats the first one can’t — brand-new, custom, or obfuscated code that no signature database has ever seen. If you want the broader picture of scanning approaches, see how to scan a WordPress site for malware.
Responding to an alert
Not every change is an attack, so the first step is to ask whether you expected it. Did you just update that plugin or edit that theme? Then the change is explained. If nothing you did accounts for it — a modified core file, a new file you didn’t create, a change at 3am — treat it as a compromise and investigate: preserve the evidence, find the entry point, and remove it. A site that keeps showing unexplained changes has a backdoor that wasn’t fully removed, which we cover in why your WordPress site keeps getting hacked.
DefendMyWP includes integrity monitoring built on official WordPress.org hashes plus a baseline of your own files, running on a schedule so an unexpected change becomes an alert in hours — not a nasty surprise months later.
