---
title: File integrity monitoring
canonical: https://wpsecurityninja.com/dictionary/file-integrity-monitoring/
---
# File integrity monitoring

File integrity monitoring checks whether important files changed compared with a known-good baseline.

Last updated: 2026-08-26

Also called: file integrity, FIM, core file scanner

## Related terms

- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [Webshell](https://wpsecurityninja.com/dictionary/webshell/): A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- [Core file integrity](https://wpsecurityninja.com/dictionary/core-file-integrity/): Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.

## Why it matters for WordPress

Attackers often tweak a core file, drop PHP under `uploads/`, or quietly edit `wp-config.php`. Integrity checks catch those edits even when a signature scanner has never seen that exact payload.

## How it shows up in practice

- Alerts that a core file no longer matches wordpress.org hashes
- New executable files outside expected plugin or theme paths
- A diff right after a plugin update (sometimes benign; still worth a glance)
- Reinfection clues: a “cleaned” file changes again overnight

## What to do

1. Compare core regularly, and again after any incident.
2. Investigate unexpected diffs before you dismiss them as noise.
3. Reinstall core (and suspect themes) from trusted packages when tampering is confirmed.
4. Pair integrity checks with malware scanning; they catch different failure modes.

## In WP Security Ninja

The [Core scanner](https://wpsecurityninja.com/core-scanner/) checks WordPress core files against known-good copies so tampering stands out. Use it beside the [malware scanner](https://wpsecurityninja.com/malware-scanner/) when you suspect a quiet edit rather than an obvious spam redirect.