Monitoring
File change monitoring
Takes a fingerprint of every code file on your site, then checks on a schedule for files that were added, changed or deleted, and tells you.
What it does
First you create a baseline: a record of every PHP, JavaScript and .htaccess file in WordPress, your plugins and your themes, as they are now.
Each scheduled scan compares the files with the baseline. Anything added, modified or deleted appears in Detected changes with its folder, size and when it changed.
Why it matters
Hacked sites almost always gain or change files. An unexpected new PHP file in a theme folder is one of the clearest warning signs there is, and file monitoring spots it within a day.
Set it up
- Make sure the site is clean first, for example by running a malware scan.
- Go to the Monitoring tab, section File integrity, and switch on File Change Detection.
- Choose a Scan schedule (daily or weekly) and a Scan time in your site's time zone, then click Save Changes.
- Click Create Baseline.
- When changes appear, check them. If they were expected, such as after an update, click Acknowledge Changes.
Good to know
Updates change files, so expect a list of changes after each one. A scan also runs a minute after any WordPress, plugin or theme update.
Folders that change all the time, such as uploads and caches, are always skipped. Add your own in section Exclusions, one folder per line, then rebuild the baseline.
Rebuild Baseline accepts every file as it is now. Only do it when you are sure the site is clean.
Scheduled scans send an email when they find changes; scans you run yourself do not.
Which plan includes it
File monitoring is part of Pro.
How it works, for developers
- Scanned: the WordPress root,
wp-admin,wp-includes,wp-content/plugins,themesandmu-plugins, up to 10 folders deep. File types:.php,.js,.htaccess. Always skipped: uploads, cache, upgrade, backup, backups, wflogs. - Fingerprint: MD5 hash plus size and modified time, stored in the
smg_file_hashestable with a status (baseline, new, modified, deleted, unchanged). - Scheduled task
smg_file_scanat the chosen time. Records of deleted files older than 30 days are removed bysmg_daily_cleanup. - Alerts use the File Changes Detected notification when it is on; otherwise a plain email goes to the site admin address.
- Settings:
smg_file_monitoring,smg_file_scan_schedule,smg_file_scan_time,smg_file_exclude_dirs.
Quick answers about file change monitoring
What does File change monitoring do in Stack Guard?
First you create a baseline: a record of every PHP, JavaScript and .htaccess file in WordPress, your plugins and your themes, as they are now. Each scheduled scan compares the files with the baseline. Anything added, modified or deleted appears in Detected changes with its folder, size and when it changed.
Why use file change monitoring on a WordPress site?
Hacked sites almost always gain or change files. An unexpected new PHP file in a theme folder is one of the clearest warning signs there is, and file monitoring spots it within a day.
How do I set up file change monitoring?
1. Make sure the site is clean first, for example by running a malware scan. 2. Go to the Monitoring tab, section File integrity, and switch on File Change Detection. 3. Choose a Scan schedule (daily or weekly) and a Scan time in your site's time zone, then click Save Changes. 4. Click Create Baseline. 5. When changes appear, check them. If they were expected, such as after an update, click Acknowledge Changes.
Which Stack Guard plan includes file change monitoring?
File monitoring is part of Pro.
More in Monitoring
Not running Stack Guard yet? It is free.
Download Free