File integrity monitoring, know the moment a file changes.

Signature and heuristic scanning both try to recognise something bad. Integrity checking does not try to recognise anything. It asks whether a file is still identical to what its authors published, and treats any difference as worth your attention.

That makes it immune to the problem that limits every other file-based layer. It does not matter whether a payload is novel, obfuscated, polymorphic, or written specifically to evade the scanner you are running. If it modified a core file, the hash changed, and the hash does not care how clever the modification was.

WordPress core is compared against the official checksums published by WordPress.org for your exact version, an authoritative external reference rather than something we generate. Plugins and themes are compared against their installed-version baselines.

Integrity findings need interpreting, and it is worth being clear about that rather than presenting every difference as an incident. A modified core file is a strong signal: WordPress core has no legitimate reason to differ from its published checksum, and anyone editing core directly has made a mistake regardless of intent.

Plugin and theme changes are more ambiguous. A developer may have patched a bug in a theme, a customisation may have been applied directly instead of through a child theme, and a partially completed update leaves files from two versions side by side. None of those are attacks; all of them show up as differences.

So findings come with what changed and where, and the useful discipline is knowing what you expect to differ. On a site where nothing should ever be edited in place, integrity checking is close to a binary answer.

Integrity checking cannot help with a file that was never clean. A plugin distributed with a backdoor already in it matches its own baseline perfectly, because the baseline is the backdoored version. This is the supply-chain case, and it is what signature, heuristic and LLM scanning exist to cover.

It also cannot see the database, where a large share of modern WordPress malware persists. A payload in wp_options changes no file at all, so every file on the site can hash correctly while the site redirects visitors to somewhere in another country.

This is the argument for layers rather than a favourite. Integrity checking is unbeatable at what it does and blind to two whole categories, which is precisely why it is one of four free layers rather than the only one.