About this plugin
When someone edits a file directly inside wp-content/plugins/ or wp-content/themes/, those changes are silently lost the next time the plugin or theme is updated. Milardovich File Modification Monitor detects those modifications before they cost you.
org repository, stores a baseline (a SHA-256 hash of every file), and compares the files on your site against that baseline. Any drift — modified, added or deleted files — is flagged in the admin, and you are warned before an update would overwrite your customizations.
Key features
- Baselines from WordPress.org — the reference is the pristine, official release, not the files already on disk. That is what makes real drift detectable.
- SHA-256 file comparison — fast, reliable detection of modified, new and deleted files.
- Visual diff viewer — see exactly what changed, line by line, in unified or split view.
- Inline admin warnings — modified plugins are flagged on the Plugins screen and modified themes get a badge on the Themes screen.
- Update protection — a clear warning is shown before updating an item that has custom modifications, so changes are never lost unexpectedly.
- Keep or revert — for any detected change, either adopt your edits as the new baseline or restore the original files from WordPress.org. Restoring is always confirmed first.
- Automatic baseline refresh — after an authorized WordPress update, the baseline is regenerated automatically.
- Configurable scan frequency — hourly, twice daily, daily, weekly or disabled.
- Scans in the background — comparisons run on a scheduled WordPress cron event, never during a page load, so the admin stays responsive.
- Optimized for large plugins — change detection compares SHA-256 hashes, so even very large plugins (thousands of files) are checked in about a second.
Use cases
- Agencies and freelancers maintaining client sites who need to know whether anyone hand-edited a plugin.
- Site owners who want an early warning before an update wipes out a customization.
- Security-conscious admins who want a simple file-integrity check against the official source.
org) to download the original release files used as the comparison baseline.
External services
org APIs to obtain the pristine copies it compares your files against. Nothing else is contacted, and no data about your site is ever sent anywhere.
- api.wordpress.org — queried to look up a plugin or theme and find the download URL for the installed version. The request contains only the public slug and version of that plugin or theme.
- downloads.wordpress.org — the original release ZIP is downloaded from here, unpacked into the server’s temporary directory, hashed, and then deleted.
These requests happen only when a baseline is created or refreshed: when you run a scan, when you refresh a single baseline, or after WordPress updates a plugin or theme. No personal data, site URL, or usage statistics are transmitted, and the plugin sets no cookies and loads nothing on the front end.