🎉 Launch offer: 20% off Pluginivo licenses
Register Browse Plugins
← Back to plugin Plugin documentation

File Integrity Monitor PRO for WordPress

Installation, licensing, configuration, updates and troubleshooting for this specific plugin.

File Integrity Monitor PRO for WordPress Current version: 1.0.5 View plugin

Documented release: v1.0.5. This release aligns the distributed package and documentation version; no new feature or bug-fix claims are made.

Pluginivo File Integrity Monitor PRO for WordPress records changes to site code files using SHA-256 baselines. Use alerts and the event log to investigate unexpected changes. File monitoring helps with visibility; it does not diagnose or remove malware.

Requirements and monitored files

Requires WordPress 6.2+ and PHP 8.0+; WooCommerce is not required. Monitors WordPress core, plugins, themes, mu-plugins and wp-content drop-ins. Uploaded media and cache directories are excluded from code monitoring. Disable the Free edition before activating PRO; existing baseline data can be reused.

Install PRO and build a trusted baseline

  1. Make a verified backup and ensure the current website files are trusted.
  2. Deactivate the Free edition before installing PRO. Upload the PRO ZIP under Plugins → Add New → Upload Plugin and activate it.
  3. Open File Integrity → Settings and check the monitoring configuration.
  4. Allow initial baseline creation to run in batches. Review the scan status before interpreting new events.

A baseline records the state of files at the time it is created. It does not guarantee that those files were clean or uncompromised.

Configure scan intervals and alerts

  1. In File Integrity → Settings, select an interval: 15 minutes, 30 minutes, hourly, twice daily or daily.
  2. Enter one or more recipient addresses, one per line. An empty list disables email alerts.
  3. Set a notification cooldown (default 15 minutes) to reduce duplicate messages.
  4. Review excluded paths and the batch size (default 500 files). Avoid excluding areas that contain executable code without a reason.

Scans rely on WP-Cron and traffic. A configured 15-minute schedule does not guarantee that a scan finishes every 15 minutes.

Run a manual file integrity scan

  1. Open File Integrity → Log and click Scan now.
  2. Keep the browser tab open while the manual scan runs and review the progress indicator.
  3. After completion, filter the log for added, changed or removed files.
  4. If the tab was closed, wait for the processing lock to expire before restarting or allowing scheduled processing to resume.

Understand New, Notified, Acknowledged and Accepted

  • New: a change was detected and awaits review.
  • Notified: a notification was sent, but review is still needed.
  • Acknowledged: an administrator marked the event reviewed without changing the baseline.
  • Accepted: the changed file was verified as correct and the baseline was updated.

Only accept a file after confirming its origin, for example through a known plugin update or a verified deployment. “Delete accepted events” removes records, not files from the server.

What to do after an unexpected file change

  1. Compare the event time with recent WordPress core, plugin and theme updates.
  2. Review the exact relative file path and change type; confirm whether someone deployed code manually.
  3. If the change is unexplained, secure administrator access and obtain a known-good backup or hosting logs before altering files.
  4. Check the source file against the vendor release where possible. Do not accept an unfamiliar change merely to silence alerts.
  5. If compromise is suspected, use appropriate security incident-response and malware-analysis tools; this plugin is not a malware cleaner.

Enable independent WordPress core checksums

PRO can optionally check WordPress core files daily against official WordPress.org checksums. This is separate from your local baseline and is disabled by default. Only core files are verified this way; plugin/theme files are compared with the stored baseline.

Core verification sends the WordPress version and locale with the standard WordPress HTTP User-Agent. It does not upload the contents of your local files.

Troubleshoot missing scans or alerts

  • Scans start late: check WP-Cron, scheduled tasks and whether the website receives traffic.
  • No email arrives: verify recipients, cooldown and WordPress mail delivery.
  • Many alerts follow a deployment: confirm which updates were recognized and which files need manual review.
  • One-file plugin update triggers an alert: a single-file plugin may need additional review even after update detection.
  • Uninstall behaviour: deactivation stops scheduled jobs; stored data remains by default unless the data-deletion setting is intentionally enabled before uninstalling.

Frequently asked questions

Does File Integrity Monitor remove malware?

No. It detects file changes and supports investigation, but is not a firewall, signature scanner or cleanup product.

Are alerts immediate?

No. They follow a scan and may be delayed by WP-Cron and notification cooldowns.

Can I monitor my WooCommerce shop?

Yes. WooCommerce is not required; the plugin monitors supported WordPress code areas regardless of e-commerce use.

Updates and support

Back up your site before updates. Annual plans include updates and technical support for their term; the installed plugin continues working when that entitlement expires. Check your Pluginivo account for downloads and license details.

For support, provide the plugin version, WordPress/PHP versions, steps to reproduce the issue and a redacted error message. Never publish license keys or customer data. Pluginivo Support.

Related resources

Next step: view the plugin and its live demo. Browse more practical articles in the Pluginivo blog.