About this plugin
org for the exact version you have installed, and looks at the places that no official copy covers.
What it finds
- WordPress files that were modified, added or deleted.
- Plugin and theme files that differ from their official version, including files that should not be there.
- Code where code never belongs: PHP files in your media library, PHP hidden inside images, translation files that run code, code files in folders next to WordPress (a favourite hiding place for intruders’ tools).
- Dangerous settings: a wp-config.php that runs code,.htaccess rules that send search engines elsewhere, a PHP setting that loads a file before every page.
- A security plugin that is still active but whose files have disappeared.
org. IntegriFix takes a snapshot of each plugin and theme when WordPress installs or updates it, and uses it as the reference for later scans.
Repair, one point at a time, and undo
When the official copy is known, IntegriFix can put things right for you, one point at a time and only when you ask:
- Replace a modified WordPress, plugin or theme file with its official copy from WordPress.org, or put back an official file that was deleted.
- Set aside (“quarantine”) a code file that has nothing to do where it is, such as PHP in your media library.
- Reinstall from WordPress.org an active plugin whose files have disappeared.
Before anything is written, the official copy is checked against its published checksum and the current file is copied to the database (kept 30 days). The file is then checked again, and the previous state is put back if it does not match. Each repair can be undone in one click, as long as the file has not changed since.
htaccess …) are never changed automatically, nothing is written when your site forbids file changes ( DISALLOW_FILE_MODS ), and a repair is offered only to people allowed to update WordPress, plugins or themes (and to install plugins, for a reinstallation).
Every repair is available in this plugin, without limit. IntegriFix Pro, a separate paid add-on, repairs several points at once.
Automatic scans and e-mail alerts
IntegriFix checks your site on its own every week (or every day), in short steps in the background with the scheduled tasks of WordPress (WP-Cron), and e-mails the administration address when a new problem appears: a point that needs your attention or deserves a look and that the previous scan did not find. One e-mail per scan, in plain words, with a link to the results and without the names or the content of your files.
The frequency and the addresses can be changed in the settings, and the automatic scans or the e-mail turned off.
Built to avoid false alarms
- Always the reference of the installed version, never “the latest”.
- Localised WordPress builds, bundled themes, translation files and files transferred by FTP in text mode are recognised.
- Each finding says what happens, why it matters and what to do.
For developers
- wp integrifix scan and wp integrifix verify core|plugin|theme for WP-CLI.
- A JSON report for your own tools.
External services
IntegriFix needs the official reference of each file. org, and only while a scan runs (started by you or automatic), when you open the comparison of a file or when you ask for a repair:
- api.wordpress.org — checksums of WordPress core. Sent: the WordPress version and the language of your installation.
- api.wordpress.org — whether WordPress.org hosts an active plugin whose files are missing, so that its reinstallation can be offered. Sent: the folder name of that plugin.
- downloads.wordpress.org — checksums and packages of plugins and themes, and the package of a plugin you ask to reinstall. Sent: the folder name and version of each installed plugin and theme.
- core.svn.wordpress.org, plugins.svn.wordpress.org, themes.svn.wordpress.org — the official copy of a single file, to show you what changed or to repair it. Sent: the path of that file and the version of its plugin, theme or WordPress.
No data about your site, your visitors or your content is sent: not even its address, since these requests go through IntegriFix’s own HTTP client, which identifies itself only as IntegriFix and its version. org/about/privacy/
The alert e-mail of the automatic scans is sent by your site itself, with the WordPress mail function (wp_mail), to the addresses set in the IntegriFix settings; nothing is sent to IntegriFix or to any other service.