A firewall stops what tries to get in. A malware scanner looks for what’s already infected. But what happens if someone changes a single line in a legitimate file, without installing anything new and without triggering any known malware signature? That’s exactly where File Integrity Monitoring (FIM) comes in — and it’s the piece most WordPress sites are missing.
What File Integrity Monitoring (FIM) Is
The fingerprint of every file
FIM calculates a unique fingerprint (a hash) for every file in your WordPress — core, plugins, themes — and stores it as a reference (the “baseline”). From there, it compares that fingerprint against the current one continuously: if a single character changes, the hash changes completely, so there’s no need to compare the entire file, just the fingerprint.
Why this catches what antivirus can’t
A malware scanner looks for already-known patterns: backdoor signatures, obfuscated code, suspicious functions. But an attacker who subtly modifies a legitimate file — for example, adding a single line to your theme’s functions.php — might not trigger any signature at all. FIM doesn’t need to recognize the attack: it only needs to know that file is no longer what it was yesterday.
Real-time vs. scheduled monitoring
There are two ways to run a FIM: in real time (checks continuously, without depending on a fixed time) or on a schedule (once a day, for example). Real-time mode catches the change within minutes; scheduled mode can take up to 24 hours to warn you about a modification that’s already been sitting there since early morning.
How SeenSecure Protects Your WordPress
Watching thousands of files with its own detection system
SeenSecure continuously watches thousands of files — WordPress core, every installed plugin, and every installed theme — using its own change-detection system. Any alteration gets logged with the exact file, date, and time.
You decide what to do with each change
Not every change is an attack: a legitimate plugin update also modifies files. That’s why every detected change stays pending for review — you can approve it (if you know it was you, or a legitimate update) or flag it for investigation, without SeenSecure deciding for you before you’ve even seen it.
A whitelist for files that change by design
Some legitimate files change constantly by their own nature — logs, caches, temporary data files. Adding them to the whitelist avoids constant alerts without letting up on watching everything else.
Real-time mode by default
SeenSecure watches continuously, not just once a day — so an unauthorized change shows up in your dashboard within minutes, not the next day.
What to Look for Before Choosing a FIM Solution
- Does it watch core, plugins, AND themes? Some solutions only cover WordPress core files, leaving out exactly where malicious changes tend to hide.
- Is it real-time or only scheduled? A once-a-day scan can leave a change undetected for hours.
- Does it let you decide, or does it act on its own without telling you? You need to see the change before any automatic decision is made about it.
- Does it support whitelists for files that change by design? Without this, any cache or log file triggers constant alerts until you start ignoring them.
Frequently Asked Questions
Does FIM slow down my WordPress?
Comparing fingerprints is a lightweight operation compared to scanning each file’s full content, so the performance impact is minimal, even in real-time mode.
Does a FIM replace a malware scanner?
No — they’re complementary. A malware scanner looks for known malicious patterns; FIM detects any change, whether or not it’s recognized as malicious. Together they cover far more than either one alone.
What do I do if FIM detects a change I don’t recognize?
Check the exact file and the timestamp shown. If it wasn’t you and doesn’t correspond to any update you made, treat it as a serious signal and review the rest of your site (malware scanner, passwords, users) as soon as possible.