KakapoWP KakapoWP
Log in Try for free
Kakapo Security

File watcher

It knows no right or wrong — only different from what was last confirmed.

On the first run, the watcher creates a checksum for every file and stores it as the baseline. Every later run holds the installation against exactly that baseline: changed, new, missing. The baseline never moves on by itself — only when you accept a finding does the new state count as correct. For wp-config.php, drop-ins and mu-plugins the alert goes out without waiting for the end of the run.

Try it free for 24 hoursAll Security features

File watcher

Checksum per file · changed, new or missing compared with the confirmed baseline

ActiveAccept the baseline

What the file watcher offers

Checksum per file against the confirmed baseline
sha256 where PHP provides it — otherwise md5
Three kinds of finding: changed, new, missing
Instant alert for wp-config.php, Drop-ins, mu-plugins
The run goes in batches: 400 files or 5 seconds per step out of the box
The exclusion list is viewable, your own patterns can be added

Here's how it works

1

The first capture creates the baseline

2

Each run compares file by file

3

Review the finding, then accept the baseline

FAQ about the file watcher

Why doesn't a finding disappear on its own?
Because the comparison is against the last confirmed baseline, not against the last run. If every run carried the baseline forward, a smuggled-in file would have legalised itself after a single run. The finding therefore stays until you press “Accept baseline” — after that the old checksum is gone.
Does the watcher find a backdoor that was already there before the first baseline?
No. Whatever is on disk at the first inventory is remembered as the correct state — foreign code included. The question “is this the real WordPress at all?” is the job of the file integrity check, which holds the core against the checksums from WordPress.org; suspicious patterns are the malware scan's job.
What is left out?
Out of the box, the uploads directory plus cache, temp and log files — both can be switched off, in which case the run takes longer and every image upload produces a finding. Files larger than 16 MB are not read but counted and listed as “not checked”. The run does not follow symbolic links.

More security features

File integrity →Malware scan →Notifications →
Ready?

Try Security free for 24 hours.

No credit card, no risk. Up and running in 2 minutes.

Try it for free now