WordPress file integrity monitoring
WordPress.org publishes checksums for every core release and for the plugins it hosts. The scanner compares your files with those checksums and lists any that differ, with a diff view so you can see exactly what changed. It rescans after installs, so a fresh update doesn't sit unchecked until the next day.
Themes, premium and custom plugins, must-use plugins and drop-ins have no official checksums, so they are watched another way. The files present at the first scan become a baseline, and after that any PHP file that appears or changes is a finding. When a theme or plugin updates, its baseline is retaken, so an update isn't reported as an attack. The baseline trusts whatever was there when watching began, so scan a site you believe is clean.
On by default.
PHP files that shouldn't be there
A common sign of a break-in is a PHP file where none belongs. The scanner flags executable files dropped into your uploads folder and files inside WordPress core that aren't part of the release. It also notices a tampered wp-config.php or .htaccess. What to do with a flagged file is covered on WordPress malware removal.
On by default, as part of every scan.
A WordPress database malware scan
Not all malware lives in files. The database scan looks for three things attackers plant there:
- a hijacked site URL that sends visitors elsewhere;
- PHP code stored in autoloaded options, which WordPress loads on every page;
- malware inside published content.
On by default.
A second opinion from the cloud
When the scan flags a PHP file, the plugin can ask the WP SecureGate service for a verdict. Only files the scan already flagged are sent, up to 5 MB each, and wp-config.php and .htaccess are never sent. The server keeps the file's hash and the verdict, not the file.
Files the rules can't decide may be reviewed by an AI model through OpenRouter, using providers that don't train on the content. A verdict never changes a file; it only helps you decide what to do. The privacy page lists everything that leaves your site.
On by default with an opt-out. Needs an active licence.
How often it scans WordPress for malware
Scans run once a day by default, or every 12 hours if you choose. A scan also starts about a minute after a plugin or theme is installed, updated or activated, which is when unwanted code is most likely to arrive.
Daily by default. The 12-hour schedule is opt-in.
Exposed files
Files like debug.log or a forgotten backup can hand an attacker your paths, settings or whole database. The scan finds them. On Apache and LiteSpeed, "Block it now" writes a rule and confirms it works. On nginx, "Take it off the site" moves the file to quarantine and shows you the nginx rule to add. More server-side fixes are in WordPress security hardening.
Checked on every scan. Fixing a file is a manual click.
Abandoned and closed plugins
A plugin that wordpress.org has closed, often over an unpatched security hole, or one that has been abandoned, won't get the fix you need. A daily check flags both. Only the public plugin slugs are sent to make the check.
On by default.
Part of WP SecureGate: Malware removal →