About this plugin
InTouch Integrity Guard is not a malware scanner and does not try to be one. It does a few focused things, all designed to run in the background without adding weight to a single front-end page load: Incremental file integrity checking. Compares WordPress core, plugin and theme files against known-good checksums from WordPress.org, and tracks your own file hashes locally so unchanged files are never re-hashed. Everything heavy runs in small batches via WP-Cron — never synchronously on a visitor’s request. Optional hardening toggles. Disable XML-RPC, block the file editor, hide the WordPress version, stop user enumeration (both the classic ?author=N probe and the REST API users endpoint), disable directory listing, send basic security response headers, and reduce automated bot noise against the login page — each one an independent, reversible switch, never forced on. Brute-force login protection. Blocks an IP after repeated failed logins, with configurable thresholds, backoff and a whitelist — checked with a single indexed query, before WordPress even attempts to verify a password. Opt-in known-vulnerability alerts. Off by default. If you turn it on, a once-a-day check (never on a page load) compares your installed plugins, themes and core version against a public vulnerability database and emails you a digest if something needs attention. This is the plugin’s only feature that contacts a third-party service — see External services below. InTouch Integrity Guard deliberately does not include a heuristic malware/YARA scanner, an always-on web application firewall, or automatic malware removal. If you need those, this is not the right tool — InTouch Integrity Guard is the lightweight layer that watches for unauthorized file changes and closes the easy doors, not a full security suite replacement. Features: Incremental file integrity index (SHA-256, hash/mtime short-circuit so unchanged files are skipped) WordPress.org core and plugin checksum comparison, with orphan/unknown-file detection Batched, cron-driven scanning — never a blocking scan on page load Independent hardening toggles with automatic backup/restore of any file they touch Brute-force login protection with IP whitelist and reverse-proxy-aware IP detection A hidden honeypot field on the login form, feeding into the same brute-force protection Optional custom login URL, to cut down on automated bot traffic against wp-login.php/wp-admin REST API user-enumeration blocking, alongside the classic ?author=N block Optional security response headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) Opt-in daily known-vulnerability check (off by default) with a single digest email Admin dashboard with an aggregate security score, last-scan status, known vulnerabilities and 24-hour brute-force block count — the score and file-integrity counts refresh live while a scan runs, no manual reload needed Flagged-files list — every non- ok tracked file (modified, missing or unrecognized) with a paginated view, a read-only file content viewer, a direct link to the official plugin/theme/core source for comparison, and a CSV export for checking the list with external tools A commercial plugin sharing its free counterpart’s WordPress.org slug (a common pattern — e.g. a Pro edition installed under the free plugin’s folder name) is flagged as a likely different edition instead of flooding the list with unexplained “unrecognized” files, and doesn’t count against the security score Blocked IPs list — every IP currently blocked by brute-force protection, with a one-click unblock and a one-click “add to whitelist” External services Always active (core functionality): api.wordpress.org — used to retrieve the official checksum list for the installed WordPress core version, so the integrity scanner can tell an unmodified file from a genuinely changed one. The WordPress version and locale are sent when the checksum list is fetched (then cached locally for 24 hours). No personal or site-identifying data is sent. This host is operated by the WordPress project: terms / privacy . downloads.wordpress.org — used the same way, to retrieve checksums for installed plugins hosted on the WordPress.org Plugin Directory. Only the plugin slug and installed version are sent, and only for plugins that WordPress’s own update-check data already lists as wp.org-hosted; premium/custom plugins are never queried. This host is operated by the WordPress project: terms / privacy . Opt-in, disabled by default: WPVulnerability API — used only to check your installed core, active plugins and active theme against a database of known vulnerabilities, and to email the site admin if a match is found. Endpoint contacted: https://www.wpvulnerability.net/ — the public, key-less REST API. The service (API and policies alike) is operated by ROBOTSTXT (Barcelona, Spain); its policy pages are published on the company site wpvulnerability.com / robotstxt.es and cover this same API. This is off by default. No request is made and nothing is scheduled until you explicitly enable it under InTouch Integrity Guard → Settings → Known-vulnerability check . You can disable it again at any time, which also clears any stored results. What is sent, and when: once every 24 hours, via WP-Cron (never on a front-end page load), the plugin sends the component type ( core , plugin or theme ), the slug and the installed version number of each active component. No site URL, domain, IP address, admin email or other identifying data is sent, and no account or API key is required. Responses are cached locally for 12 hours. Provider: ROBOTSTXT — privacy policy , terms / legal , FAQ .