Guardian Gaze hashes every WordPress core, plugin, theme and mu-plugin file against a verified baseline. Any byte-level change (whether it's a legitimate update, a sloppy code edit, or a malicious modification) is recorded, attributed and surfaced for review.
When Guardian Gaze is activated, the first thing it does is build a baseline, a cryptographic fingerprint of every file in your WordPress install. WordPress core files are hashed against the official manifest published by WordPress.org so we know exactly which bytes should be present. Plugin and theme files are hashed against their currently-installed version. From that moment on, every subsequent scan compares against this baseline.
Most compromises modify at least one file, a webshell dropped in uploads/, a backdoor wedged into a plugin's functions.php, a hijackedwp-config.php. File integrity monitoring is the layer that surfaces those modifications even when the attacker is careful enough to evade signature detection.
All files under wp-admin/, wp-includes/, and the root core files. Hashed against the official WordPress.org checksum manifest for your version.
Every file under wp-content/plugins/, including plugins that aren't currently active, inactive plugins are a common dumping ground for backdoors.
All theme files. Particular attention to functions.php,header.php and footer.php, the classic injection targets for SEO-spam and redirect malware.
Must-use plugins in wp-content/mu-plugins/ and drop-ins likeadvanced-cache.php auto-load on every request. Backdoors here survive plugin deactivation, we scan them by default.
Hashed and tracked separately because it contains your secrets. Modifications here are flagged Critical regardless of who made them.
Any PHP file appearing in wp-content/uploads/ is suspicious by default, uploads should be media, not executable code. Every PHP file is flagged.
A finding isn't just "a file changed". Each integrity event includes everything you need to decide whether the change is legitimate or hostile.
Injection into the active theme's functions.php · web shells uploaded to wp-content/uploads/ · backdoors in mu-plugins/ · modified wp-config.php with extra constants · plugin update routines trojanised with conditional payloads.
A custom-written backdoor with no known signature still has to live somewhere. As soon as it's written to disk, the file's hash diverges from the baseline, and integrity monitoring catches it even before the malware scanner does.
When you update WordPress, a plugin, or a theme, hundreds of files change at once. Guardian Gaze correlates batches of changes against known version bumps and groups them under a single "Plugin X updated to 4.2.1" event so your dashboard doesn't fill with false-positive noise.
Baseline scans and change detection are included on every tier. The Pro tier adds real-time monitoring, instead of waiting for the next scheduled scan, file changes are detected and alerted within minutes.
| Capability | Free | Pro | Agency |
|---|---|---|---|
| Baseline scan | ✓ | ✓ | ✓ |
| Core, plugin, theme & mu-plugin tracking | ✓ | ✓ | ✓ |
| Change detection cadence | Daily | Real-time | Real-time |
| Version-update correlation | ✓ | ✓ | ✓ |
| Cross-reference with malware findings | ✓ | ✓ | ✓ |
| Alert on permission changes | ✗ | ✓ | ✓ |
Install Guardian Gaze and the first scan produces your integrity baseline within 5 minutes. From then on, every change is tracked, attributed and ranked.