About this plugin
php…) files, and sends an email alert after the next scan detects that one of them has been changed, added, or deleted WITHOUT the change going through an official WP update mechanism. This is often the earliest sign that a site has been compromised (malware injection, backdoor, defacement).
It reports file changes. It does not scan file contents for malware signatures, and it does not clean or repair anything.
How it works
- On activation, the plugin builds a “baseline” — a SHA-256 hash of every tracked file, stored in its own database tables (not wp_options, because of the large number of files).
- A recurring scan compares the current state of files against the baseline and reports differences as events: added, modified, deleted. You choose how often it runs in Settings > Scan interval: every 15 minutes, every 30 minutes, hourly, twice daily, or once daily. The default is once a day at 03:00 (site time). You can also start a scan yourself at any time with “Scan now” — there is no limit on how often.
- Scanning runs in batches (configurable, 500 files per pass by default) so it doesn’t time out even on sites with lots of files. “Scan now” runs the batches back to back until the whole pass is finished, with a progress indicator while it works. The automatic scan does the same in the background: a large site is scanned in several consecutive steps, which depends on WP-Cron.
- When you update a plugin, theme, or WordPress core through WP admin (or WP-CLI, including automatic background updates), the plugin recognizes this and automatically refreshes the baseline for those files — you won’t get false alerts for legitimate updates. This covers plugins that live in their own folder; single-file plugins (such as hello.php) are not covered by the update tracker and will show up as changes after an update.
- Every other change is listed as New. Once an alert email has been sent for it, its status becomes Notified (it still needs your review). You then review it in the dashboard: “Accept as correct” updates the baseline (status becomes Accepted), while “Mark as reviewed” (status becomes Acknowledged) leaves the baseline unchanged — the file stays listed under Acknowledged and no new alert is sent for it unless its contents change again. Apart from the initial baseline build and an explicit “Accept as correct”, the baseline is NEVER changed except through a recognized WP update — this is a deliberate security choice, not an oversight.
- Email alerts are sent after a scan finds changes, in batches (all unresolved changes in a single email, which lists up to 200 of them in detail and gives the number of the rest), with a cooldown period (configurable in minutes, 15 by default) so you’re not flooded with dozens of emails if a lot of files change at once. The default recipient is the site admin email set at activation; add as many recipients as you like, one per line. Leave the Email recipients field empty to turn email notifications off completely; changes are then only visible in the dashboard and stay New.
- Excluded paths: enter as many patterns as you need (one per line) to skip files or folders; a few common ones are filled in by default.
The dashboard
- “Trusted Files” shows how many files are currently confirmed as normal — from the initial setup, or after you reviewed and accepted them. Newly detected files stay separate until you review them.
- One tab per status — New, Notified, Acknowledged, Accepted — plus All, each with a count.
- Search by file path, and bulk actions on ticked rows: “Mark as reviewed”, “Accept as correct”, and “Delete accepted events”. When a search is active on the New or Notified tab, “Select all N items matching this search” applies the action to every match across all pages. “Delete accepted events” only ever removes events whose status is Accepted, and asks for confirmation first.
- “Next scan” shows when the next automatic scan will run. “Scan now” has two visible states. Ready: the button is enabled and can be used at any time. Scan running: the button is disabled and a progress bar shows “Scanning n / total files…” (the same page shows “A scan is currently running…” if the scan was started from another browser tab or by the automatic schedule), and your browser asks for confirmation if you try to leave the page.
- While changes are waiting for review, administrators see one notice on the WordPress Dashboard and Plugins screens. It can be dismissed; the dismissal is remembered for your user only, and the notice comes back only when a newer change is detected.
External services
P-ivo File Integrity Monitor does not connect to any external service, load remote assets, or send data outside your site. Email alerts are sent through your site’s own mail configuration (wp_mail).
Credits
The admin screens use the IBM Plex fonts (Plex Sans, Plex Serif and Plex Mono), Copyright © 2017 IBM Corp. 1. txt.
A separate version
org, adds an independent check of core files.