adminFile Integrity and Unauthorized Change Detection Checklist
Unauthorized file changes are a major signal of compromise. Attackers may add PHP files, modify themes, inject redirects, edit config files or create hidden backdoors. File integrity review helps detect changes before they spread.
Core principle
Healthy systems have expected files in expected places. Unexpected executable files, recent modifications and unknown plugin folders should be investigated.
Checklist
- Record the website root path.
- Check recently modified files.
- Check executable files inside uploads.
- Check unknown plugin folders.
- Check unknown theme files.
- Compare WordPress core with a clean version if possible.
- Check wp-config.php changes.
- Check suspicious hidden files carefully.
- Document findings before deleting files.
- Monitor the same paths after cleanup.
Reusable lesson
File integrity thinking applies to WordPress, custom PHP apps, uploaded assets, config files, Docker bind mounts and automation scripts.
When to Use This Checklist
Use this checklist when a website may be hacked, redirected, injected or modified without permission.
Required Tools
SSH access, website root path, backup, WordPress files, plugin list, theme list, file timestamps
Before You Start
Do not delete suspicious files before documenting them and taking a backup of the current state for investigation.
Structured Checklist Steps
- Record root path.
- Find recently modified files.
- Check uploads for executable files.
- Check plugin folders.
- Check theme files.
- Compare core files.
- Check wp-config.php.
- Check hidden files.
- Document findings.
- Monitor after cleanup.
Verification Steps
- Recent file changes are reviewed.
- No unknown executable file remains in uploads.
- Unknown plugin or theme folders are investigated.
- Important config files are verified.
- Post-cleanup monitoring is active.
Rollback Plan
If removing a suspicious file breaks the site, restore it from backup temporarily, then analyze whether it was required application code or part of a compromise.
Common Mistakes
- Deleting files without backup.
- Ignoring uploads folder.
- Assuming hidden files are always safe.
- Not checking wp-config.php.
- No monitoring after cleanup.
Related Commands
find /var/www/example.com -type f -mtime -7
find /var/www/example.com/wp-content/uploads -name "*.php"
ls -la /var/www/example.com/wp-content/plugins
ls -la /var/www/example.com/wp-content/themes
stat /var/www/example.com/wp-config.php