File integrity monitoring — your supply-chain tripwire.
Relvato compares your WordPress core and wp.org plugin files against their official checksums — and goes past them. It lists PHP files in wp-admin and wp-includes that WordPress doesn't ship, plugins that appeared without being installed through WordPress, plugins hidden from the Plugins screen, security plugins switched off by renaming their folder, and code running from where no plugin, theme or WordPress put it.
- ✓Core files match the official WordPress checksums
- ✓wp.org plugin files match their release checksums
- ✓No PHP files in wp-admin or wp-includes that WordPress doesn't ship
- ✓Every plugin was installed through WordPress, none is hidden, and no security plugin was switched off by renaming
- ✓No code running from where no plugin, theme or WordPress put it
- ✓Options holding PHP code or one large encoded blob, flagged for review
A tampered core file is how a backdoor survives — it looks identical in your dashboard. But the malware that keeps coming back usually doesn't touch a file with a checksum at all: it adds a file beside core's own, copies in a plugin and hides it, renames your security plugin's folder to switch it off, and runs from a string stored in the database. File integrity looks for all of those, so a reinstall or a scan that came back clean isn't where it ends. More in why WordPress malware keeps coming back.
Cleaned the site and the malware came back? The code usually survives outside the files a scan checks — in wp-config.php, .htaccess, the database or a hidden admin. Our guide shows where to look.
- Fetches the official checksums for your exact WordPress and plugin versions; the plugin hashes the installed files and reports any that are modified or missing.
- Lists PHP files in wp-admin and wp-includes that aren't in WordPress's own checksum list — a reinstall overwrites core's files but leaves an added one in place.
- Keeps a record of every plugin WordPress installs from the moment it starts watching, and reports a plugin that turns up any other way, one hidden from the Plugins screen, or a security plugin whose folder was renamed.
- Traces every hook, scheduled task and REST route back to where its code was defined, and reports code evaluated outside a plugin, created at runtime or sitting in uploads — the loader self-healing malware runs on every request.
Does it read my file contents?
No. The plugin compares hashes and looks up where code is defined on your server, and reports only file paths, plugin names, hook names and places — never file contents, code or option values.
Which files are covered?
WordPress core and wp.org plugins by their official checksums; wp-admin and wp-includes for files WordPress doesn't ship; every installed plugin for how it got there; and every hook, scheduled task and REST route for where its code lives. Your theme, wp-config.php and .htaccess are covered by the Theme integrity monitor.
I deploy plugins with git or Composer. Will every one be flagged?
A plugin that arrives by file instead of through WordPress's installer is reported once; ignore it on the run and it stays quiet. The record starts from what's installed when the plugin starts watching, so plugins you already have aren't reported.
Does it need the plugin?
Yes — it reads the files through the Relvato plugin, so it's WordPress-only. Keep the plugin up to date through your normal WordPress updates: the newest detections (files core doesn't ship, how plugins got there, where code runs from) arrived in versions 1.14 to 1.16.
Put this monitor on autopilot.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.