Real-time file monitoring, catch the change the moment it happens.
Guardian Gaze creates a secure baseline of every core, plugin, theme, and custom file on your site. On every scan, it compares current files against this baseline to instantly detect unauthorized changes, new files, or deletions, the most common signs of a hack. Spot a suspicious change? Review the diff, then approve it as legitimate or flag it for removal, all from one dashboard.
Availability: included from Basic upwards, via the Premium add-on · Real-time file monitoring with SHA-256 baselines
The plugin view: findings, severity and next steps inside the WordPress admin
Real-Time File Monitoring at a glance
Baseline created
On install, Guardian Gaze fingerprints every file in core, themes, plugins, mu-plugins and your uploads directory with a SHA-256 hash.
Continuous comparison
Every scheduled scan re-hashes the filesystem and compares against the baseline. New files, changed files and deletions are all surfaced.
Diff review
For text files you see a side-by-side diff of what changed, not just that it changed. Context matters for triage.
The gap between compromise and discovery is where the damage is
The total cost of a compromise is not set at the moment of the breach. It accumulates during the interval before anybody notices, and that interval, on an ordinary WordPress site, is routinely measured in days or weeks.
What accumulates is specific and expensive. Card details are skimmed from a checkout for as long as the skimmer runs. Spam pages get indexed, and once they are indexed, removing them does not immediately remove them from search results. Your domain reputation is spent sending mail nobody asked for, and rebuilding it takes months. Search engines start showing an interstitial warning next to your name.
A daily scan means a payload has most of a day to operate. Real-time monitoring narrows that to the time it takes you to read a notification, which is why email notifications arrive at the same tier, a monitor that nobody is told about is just a log file.
SHA-256 baselines, and the discipline of a quiet alert stream
The monitor maintains SHA-256 hashes of your files and watches for divergence continuously rather than on a schedule. When a file changes, appears or disappears, that is an event, not something waiting for the next scan window.
The hard part of any real-time monitor is not detection: it is noise. WordPress writes files constantly during normal operation: updates rewrite whole directories, caching plugins generate and discard files by the thousand, log files grow, uploads arrive. A monitor that alerts on all of it gets muted within a week, and a muted monitor is worse than none because it produces the feeling of coverage without the fact.
So the useful configuration is exclusions that reflect how your site actually behaves (cache directories, log paths, anything generated as a matter of course) so that what remains is genuinely worth reading. An alert stream you still trust after a month is the whole objective.
Quarantine makes the alert actionable
An alert is only useful if there is a safe response to it, and at two in the morning the safe response is not deleting something from a live production site on the strength of a notification.
Quarantine, which arrives at the same tier, lets you isolate the file so it cannot execute while you work out what it is. If the judgement was wrong, restore it. That reversibility is what makes people act promptly rather than deferring until they have time to investigate properly, and deferral is how a two-minute containment becomes a two-day incident.
The audit log completes the picture. Monitoring tells you a file changed; the log tells you which account was active, when, and what else it touched, which is the difference between containing one file and understanding the scope.
Real-Time File Monitoring - common questions
Which plan includes real-time monitoring?
Basic and above. The free plugin includes scheduled file integrity checking, which finds the same changes on the next scan rather than as they happen.
Will it flood me with alerts?
Not if it is configured for how your site behaves. WordPress writes files legitimately all the time, so excluding cache and log paths is the normal first step, and it is what keeps the remaining alerts worth reading.
Does it run on my server?
Baselines and analysis are handled off your server, in line with the rest of the plugin, so monitoring does not add load to your site.
What about WordPress updates?
An update legitimately changes many files at once, and shows up as such. Knowing an update ran is exactly why the audit log sits alongside monitoring.
Can it stop a change, rather than report it?
Monitoring detects; quarantine contains. Preventing the change in the first place is what hardening and the firewall are for, different layers, different jobs.
Works with
File Integrity →
Byte-level change detection on every file.
Malware Scanning →
Four detection methods, cross-referenced.
Instant Email Alerts →
Stay informed without logging in.
See it on your own site
The free scan takes under five minutes and tells you the truth.