File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline.
What PowerSEC monitors
PowerSEC's File Integrity Monitoring watches for file changes across your entire WordPress installation — not just core, themes, and plugins. That includes WordPress core, plugins and themes, must-use plugins, your uploads folder, cache and backup folders, security-plugin log folders, and other non-standard directories inside the WordPress tree. Attackers often hide malicious PHP files in writable folders such as uploads or cache, so those are watched too.
For each file, PowerSEC records a content hash, the file size, and the last-modified time, and compares them against the baseline.
Versioned baseline widening
When PowerSEC's monitoring scope is expanded, it uses versioned baseline widening: newly visible files are added to the baseline quietly, without creating a flood of false "new file" alerts. After the baseline is established, future changes are reviewed normally. When you legitimately update a plugin, theme, or WordPress core, PowerSEC re-baselines the affected files automatically.
What FIM detects
✅ Modified core file — often means injected code
✅ New PHP file in a writable folder — e.g., a PHP file dropped in wp-content/uploads/ or a cache directory
✅ Plugin or theme file changed without an update — possible compromise
✅ Deleted core file — could be tampering or a partial cleanup attempt
Exclusions — use them carefully
PowerSEC still honors exclusions that you intentionally configure. Use them carefully: excluding writable folders such as uploads, cache, or backup directories reduces visibility into exactly the places attackers use to hide PHP files. By default PowerSEC does not exclude those folders. Ordinary media (images, PDFs) and constantly-changing files such as logs are not the focus of change alerts, but PowerSEC does watch for new or changed PHP-like (executable) files anywhere in the tree.
Reading FIM alerts
A FIM alert shows the file path, the change type (modified / added / deleted), and a risk score based on file location and change pattern. Database content changes (for example post_content) are handled by the separate content scanner, not FIM.
Common false positives
- Some plugins write to their own directories (backup plugins, cache plugins). PowerSEC recognizes many known-safe write patterns.
- Page builders (Elementor, Divi) modify theme files when you save changes.
- Scheduled jobs may rotate log files.
If you see repeated false positives, you can add custom exclusions per site under File Scanner settings.
What FIM is — and isn't
File Integrity Monitoring is one security signal. It helps you spot unexpected file changes, but it is not a guarantee that a site is clean, and it does not replace malware scanning, patching, checksum-verified backups, or manual review.