WordPress file change monitoring that notices first

Why file changes are the clearest sign of a hack

Hacked sites almost always gain or change files. An unexpected new PHP file in a theme folder, or an edit to a plugin you did not touch, is one of the clearest warning signs there is.

File monitoring catches those edits even when the code does not match a known malware signature, which makes it a good partner for a malware scanner. The scanner asks whether code looks bad. File monitoring asks whether anything changed that you did not change.

How WordPress file change monitoring works in Stack Guard

First make sure the site is clean, for example by running a malware scan. Then follow these steps on the Monitoring tab.

• In File integrity, switch on File Change Detection.
• Click Create Baseline. Stack Guard records a fingerprint, size and modified time for every PHP, JavaScript and .htaccess file in WordPress, your plugins and your themes.
• Scheduled scans, at the time you choose, compare the files with the baseline. Anything added, modified or deleted appears under Detected changes with its folder, size and when it changed.
• A scan also runs a minute after any WordPress, plugin or theme update.
• Scheduled scans email you when they find changes. Scans you run yourself do not.

Handle changes after updates

Updates change files, so expect a list of changes after each one. Check the list, and if the changes were expected, click Acknowledge Changes. Folders that change all the time, such as uploads and caches, are always skipped. Add your own in Exclusions, one folder per line, then rebuild the baseline.

Rebuild Baseline accepts every file as it is now, so only do it when you are sure the site is clean. Stack Guard watches the WordPress root, wp-admin, wp-includes, plugins, themes and mu-plugins, up to 10 folders deep.

404 detection, and who needs file monitoring

The same tab includes 404 detection. Scanners try hundreds of known weak files, such as old plugin paths and backup files, and each miss is logged with the address that asked. When one address hits too many missing pages in a short time, Stack Guard can ban it for the time you choose. Start with the defaults of 20 misses in 5 minutes, and leave auto-ban off at first if you want to watch before acting. A site with many broken links can catch real visitors, so fix the links if that happens.

File change monitoring suits any site that runs third-party plugins and themes, shops, membership sites and client sites an agency is responsible for. It is part of Stack Guard Pro and Agency, and it counts toward your security score.