Real-time file monitoring, catch the change the moment it happens.

The total cost of a compromise is not set at the moment of the breach. It accumulates during the interval before anybody notices, and that interval, on an ordinary WordPress site, is routinely measured in days or weeks.

What accumulates is specific and expensive. Card details are skimmed from a checkout for as long as the skimmer runs. Spam pages get indexed, and once they are indexed, removing them does not immediately remove them from search results. Your domain reputation is spent sending mail nobody asked for, and rebuilding it takes months. Search engines start showing an interstitial warning next to your name.

A daily scan means a payload has most of a day to operate. Real-time monitoring narrows that to the time it takes you to read a notification, which is why email notifications arrive at the same tier, a monitor that nobody is told about is just a log file.

The monitor maintains SHA-256 hashes of your files and watches for divergence continuously rather than on a schedule. When a file changes, appears or disappears, that is an event, not something waiting for the next scan window.

The hard part of any real-time monitor is not detection: it is noise. WordPress writes files constantly during normal operation: updates rewrite whole directories, caching plugins generate and discard files by the thousand, log files grow, uploads arrive. A monitor that alerts on all of it gets muted within a week, and a muted monitor is worse than none because it produces the feeling of coverage without the fact.

So the useful configuration is exclusions that reflect how your site actually behaves (cache directories, log paths, anything generated as a matter of course) so that what remains is genuinely worth reading. An alert stream you still trust after a month is the whole objective.

An alert is only useful if there is a safe response to it, and at two in the morning the safe response is not deleting something from a live production site on the strength of a notification.

Quarantine, which arrives at the same tier, lets you isolate the file so it cannot execute while you work out what it is. If the judgement was wrong, restore it. That reversibility is what makes people act promptly rather than deferring until they have time to investigate properly, and deferral is how a two-minute containment becomes a two-day incident.

The audit log completes the picture. Monitoring tells you a file changed; the log tells you which account was active, when, and what else it touched, which is the difference between containing one file and understanding the scope.