---
title: File integrity monitoring
canonical: https://wpsecurityninja.com/dictionary/file-integrity-monitoring/
---
# File integrity monitoring

File integrity monitoring checks whether important files changed compared with a known-good baseline.

## Why it matters for WordPress

Attackers often tweak a core file, drop PHP under `uploads/`, or quietly edit `wp-config.php`. Integrity checks catch those edits even when a signature scanner has never seen that exact payload.

## How it shows up in practice

- Alerts that a core file no longer matches wordpress.org hashes
- New executable files outside expected plugin or theme paths
- A diff right after a plugin update (sometimes benign; still worth a glance)
- Reinfection clues: a “cleaned” file changes again overnight

## What to do

1. Compare core regularly, and again after any incident.
2. Investigate unexpected diffs before you dismiss them as noise.
3. Reinstall core (and suspect themes) from trusted packages when tampering is confirmed.
4. Pair integrity checks with malware scanning; they catch different failure modes.

## In WP Security Ninja

The [Core scanner](https://wpsecurityninja.com/core-scanner/) checks WordPress core files against known-good copies so tampering stands out. Use it beside the [malware scanner](https://wpsecurityninja.com/malware-scanner/) when you suspect a quiet edit rather than an obvious spam redirect.