PressTracker

WordPress File Integrity Monitoring

PressTracker examines files throughout your installation to identify unexpected, modified, misplaced, or potentially suspicious content. It compares existing filenames, sizes, locations, and available file hashes with the files expected from a clean installation of the same software version. This comparison helps reveal missing files, unauthorized additions, and modifications that may require investigation. PressTracker also scans installed files for filenames, paths, hashes, extensions, and content patterns associated with known threats. Directory-specific policies provide another protective layer by verifying that folders intended only for media do not contain PHP files or other unexpected executable content. Each finding is classified and presented with clear details, allowing administrators to distinguish legitimate changes from suspicious activity and investigate potential compromises before they develop into more serious security incidents.

PressTracker File Integrity Monitoring infographic

Core Capabilities

Clean Installation Comparison

Compares installed WordPress core, plugin, and theme files with those expected from clean installations. Unexpected additions, missing files, size differences, and modified files are clearly identified for investigation.

Hash and Size Verification

Verifies filenames, sizes, locations, and cryptographic hashes against trusted reference data. Even when a modified file retains its original name and size, its changed contents can still be detected.

Known Threat Indicator Scanning

Examines filenames, paths, extensions, hashes, and file contents for indicators associated with known malicious files, backdoors, web shells, obfuscated code, and other suspicious modifications.

Media Folder Validation

Checks directories intended for images, videos, and other media files for unexpected executable content. PHP, PHTML, PHAR, and similar files are flagged for immediate administrator review.

Added, Modified, and Missing Files

Tracks differences between expected and installed files, distinguishing newly added, modified, relocated, and deleted items. Every detected change is presented with its location and reason for classification.

Scheduled Scans and Clear Alerts

Runs integrity scans on a configurable schedule and alerts administrators when suspicious changes are detected. Detailed findings help teams prioritize investigation without automatically classifying every unexpected file as malicious.