File integrity monitoring (FIM) keeps a fingerprint of every file on your website and checks them regularly. When a file changes and nobody updated anything, or a new file appears where it shouldn’t, it raises an alert. That can reveal a hack days before Google flags your site or a customer notices something odd.
Key takeaways
- FIM compares your files with a known-good baseline and flags anything changed, added or removed.
- It catches hidden backdoors that look normal from the outside, which ordinary visitors and many scanners miss.
- WordPress core and WordPress.org plugins publish checksums, so changes to them are easy to prove.
- FIM works best alongside malware scanning, updates and someone who acts on the alerts.
What is file integrity monitoring?
Every file can be reduced to a short fingerprint, called a checksum or hash. Change one character in the file and the fingerprint changes completely. File integrity monitoring records those fingerprints when the site is known to be clean, then checks them again on a schedule.
Any difference falls into one of three groups: a file was modified, a new file appeared or a file went missing. Some changes are expected, such as an update you just ran or a new image upload. The rest need a closer look.
Why does it catch hacks that others miss?
Most hacked sites look normal to their owners. Attackers want the site to keep running, because a working site keeps serving their spam, redirects or hidden code. The signs are often buried in a file you’d never open.
Sucuri’s analysis of hacked sites found backdoors on 49% of them, and malicious admin users in 55% of infected databases (Sucuri). A backdoor is a small file or a few lines of code that let the attacker back in after a clean-up. It may not match any known malware, but it still changes a file, so FIM can spot it.
That’s the key difference from signature-based malware scanning. A malware scan asks “does this look like known bad code?” FIM asks “has this changed when it shouldn’t have?” The second question catches new and custom code that no scanner has seen before.
How do you know a change is suspicious?
For WordPress, there’s a reliable reference point. WordPress.org publishes checksums for every core release. The official WP-CLI tool can compare your installed core files against them and warn about any file that doesn’t match (WordPress Developer Resources). A similar command checks plugins from the WordPress.org directory.
Red flags include:
- a changed core file when WordPress wasn’t updated
- PHP files in the uploads folder, which should only hold images and documents
- new files with random names, or names that imitate real ones
- a theme or plugin file changed outside an update
Premium plugins and custom themes have no public checksums. For those, the clean baseline your monitoring recorded becomes the reference.
How is this faster than waiting for Google?
Google Safe Browsing protects over five billion devices a day (Google). When it decides a site is hacked or dangerous, visitors can see a warning in search results or a full-page warning in Chrome. Search Console’s Security Issues report then lists the problem as hacked content, malware or social engineering (Google Search Console Help).
By then the damage is visible to customers. A warning can drive away visitors and enquiries until it’s lifted, and lifting it means cleaning the site and asking Google for a review. FIM looks at the cause, the changed file, rather than waiting for the symptom. If you’re already seeing a warning, start with our guide to the “this site may be hacked” warning.
What doesn’t file integrity monitoring catch?
FIM watches files. Some attacks live elsewhere:
- Database injections, such as spam links or rogue admin users stored in the database rather than in files.
- Stolen passwords used to log in and change content through the dashboard.
- Problems in the browser, which security headers help prevent.
It’s also a detection tool, not a prevention tool. Keeping plugins patched closes most of the doors in the first place. Our guide to a WordPress plugin vulnerability alert explains what to do when one hits the news.
How does this fit into website security monitoring?
FIM is one layer. Good website security monitoring combines it with daily malware and vulnerability scans, a firewall, login protection and blacklist checks. Our explainer on 24/7 website security monitoring walks through what each layer does overnight.
The server matters too. Secure web hosting isolates accounts, so one compromised site can’t tamper with another’s files. All of our website maintenance plans include daily malware scans and blacklist monitoring, and sites on Maintain & Protect are covered by our promise: hack-free or we fix it free.
Frequently asked questions
Is file integrity monitoring the same as a malware scan?
No. A malware scan looks for code that matches known threats. File integrity monitoring looks for any unexpected change, whether or not it matches a known threat. Used together, they catch more than either alone, because new or custom malicious code won’t be in any scanner’s list yet.
Will updates trigger false alarms?
They can, which is why good monitoring resets its baseline after each planned update. A change that matches an update you just ran is expected. A change on a day nobody touched the site is the one worth investigating.
Can I check my WordPress core files myself?
Yes, if you have WP-CLI access through your host. The command wp core verify-checksums compares your core files with WordPress.org’s published checksums and warns about any that don’t match. Many security plugins offer a similar check from the dashboard.
What should I do if a file has changed unexpectedly?
Don’t just delete it. Take a backup of the site as it is, then compare the file with a clean copy. If it contains code you don’t recognise, treat the site as hacked: clean it fully, check for rogue admin users and change all passwords.
Sources
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- wp core verify-checksums, WordPress Developer Resources
- Google Safe Browsing, Google
- Security issues report, Google Search Console Help