Continuous file monitoring for WordPress

What it does

Every compromise eventually touches a file: a backdoor dropped, a plugin file edited, a rogue script planted. Change detection turns that into your earliest tripwire: baseline the site once, then watch for any deviation.

How it works

The baseline hashes the risky file types (PHP, JavaScript, .htaccess and SQL) across the five critical areas. A scheduled scan (hourly by default) re-hashes and reports modified, new and deleted files, with modifications logged at high severity. Alerts go by email, and every change lands in the event stream where the incident engine can correlate it with logins and other activity.

When you deliberately change things (an update, a deploy), one click re-baselines, and per-file reset handles the single false alarm. Newly uploaded files get checked on arrival too.

• SHA-256 baseline of PHP, JS, .htaccess and SQL files
• Scheduled re-scan, hourly by default
• Modified / new / deleted classification with severity
• Email alerts and incident-engine integration
• One-click re-baseline and per-file reset

Where the malware scanner fits

Monitoring tells you a file changed; it does not judge the file. That is the AI malware scanner's job: send the suspicious file for a verdict, and quarantine it if the verdict is bad. The two are designed to be used together.