Hardening Dictionary
File integrity monitoring
Definition
File integrity monitoring checks whether important files changed compared with a known-good baseline.
Also called: file integrity, FIM, core file scanner
Why it matters for WordPress
Attackers often tweak a core file, drop PHP under uploads/, or quietly edit wp-config.php. Integrity checks catch those edits even when a signature scanner has never seen that exact payload.
How it shows up in practice
- Alerts that a core file no longer matches wordpress.org hashes
- New executable files outside expected plugin or theme paths
- A diff right after a plugin update (sometimes benign; still worth a glance)
- Reinfection clues: a “cleaned” file changes again overnight
What to do
- Compare core regularly, and again after any incident.
- Investigate unexpected diffs before you dismiss them as noise.
- Reinstall core (and suspect themes) from trusted packages when tampering is confirmed.
- Pair integrity checks with malware scanning; they catch different failure modes.
In WP Security Ninja
The Core scanner checks WordPress core files against known-good copies so tampering stands out. Use it beside the malware scanner when you suspect a quiet edit rather than an obvious spam redirect.
Go deeper
Related in Security Ninja
Related terms
Nearby ideas in the dictionary
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- Core file integrity Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.
