File integrity monitoring, know the moment a file changes.
Guardian Gaze hashes every WordPress core, plugin, theme and mu-plugin file against a verified baseline. Any byte-level change (whether it’s a legitimate update, a sloppy code edit, or a malicious modification) is recorded, attributed and surfaced for review.
Availability: in the free plugin on WordPress.org: no account, no licence key · File integrity monitoring
The plugin view: findings, severity and next steps inside the WordPress admin
File Integrity at a glance
WordPress core
All files under wp-admin/, wp-includes/, and the root core files. Hashed against the official WordPress.org checksum manifest for your version.
Plugins (active & inactive)
Every file under wp-content/plugins/, including plugins that aren’t currently active, inactive plugins are a common dumping ground for backdoors.
Themes
All theme files. Particular attention to functions.php, header.php and footer.php, the classic injection targets for SEO-spam and redirect malware.
The one detection layer that needs no knowledge of malware
Signature and heuristic scanning both try to recognise something bad. Integrity checking does not try to recognise anything. It asks whether a file is still identical to what its authors published, and treats any difference as worth your attention.
That makes it immune to the problem that limits every other file-based layer. It does not matter whether a payload is novel, obfuscated, polymorphic, or written specifically to evade the scanner you are running. If it modified a core file, the hash changed, and the hash does not care how clever the modification was.
WordPress core is compared against the official checksums published by WordPress.org for your exact version, an authoritative external reference rather than something we generate. Plugins and themes are compared against their installed-version baselines.
A changed file is a question, not a verdict
Integrity findings need interpreting, and it is worth being clear about that rather than presenting every difference as an incident. A modified core file is a strong signal: WordPress core has no legitimate reason to differ from its published checksum, and anyone editing core directly has made a mistake regardless of intent.
Plugin and theme changes are more ambiguous. A developer may have patched a bug in a theme, a customisation may have been applied directly instead of through a child theme, and a partially completed update leaves files from two versions side by side. None of those are attacks; all of them show up as differences.
So findings come with what changed and where, and the useful discipline is knowing what you expect to differ. On a site where nothing should ever be edited in place, integrity checking is close to a binary answer.
Two blind spots worth knowing about
Integrity checking cannot help with a file that was never clean. A plugin distributed with a backdoor already in it matches its own baseline perfectly, because the baseline is the backdoored version. This is the supply-chain case, and it is what signature, heuristic and LLM scanning exist to cover.
It also cannot see the database, where a large share of modern WordPress malware persists. A payload in wp_options changes no file at all, so every file on the site can hash correctly while the site redirects visitors to somewhere in another country.
This is the argument for layers rather than a favourite. Integrity checking is unbeatable at what it does and blind to two whole categories, which is precisely why it is one of four free layers rather than the only one.
File Integrity - common questions
Is file integrity monitoring free?
Yes, it is in the core plugin. Real-time monitoring with SHA-256 baselines, catching changes as they happen rather than on the next scan, is the Basic upgrade.
What is it compared against?
WordPress core against the official WordPress.org checksums for your exact version; plugins and themes against their installed-version baselines.
Why does it flag my customised theme?
Because it was customised, and the check reports difference rather than judging intent. Direct edits to a theme show up as changes; using a child theme avoids both the finding and the problem of updates overwriting your work.
Does it detect malware?
Not directly, it detects modification. A modified core file is a strong indicator regardless of what was put in it, which is why this layer survives contact with malware nothing has catalogued.
How is this different from real-time monitoring?
Timing. Scheduled integrity checking finds a change on the next scan. Real-time monitoring, from Basic, notices it as it happens, which is the difference between hours of unnoticed activity and minutes.
Works with
Real-Time File Monitoring →
Know the moment a file changes.
Malware Scanning →
Four detection methods, cross-referenced.
Audit Log →
Who did what, and when.
See it on your own site
The free scan takes under five minutes and tells you the truth.