About this plugin
org checksums and flags anything modified, missing or unexpected. It is built for agencies and site owners who want a fast, safe answer to one question: has anything on this site been changed that should not have been?
Every check is read-only. The plugin never edits, moves or deletes a file, and it never sends file contents anywhere. It reports file paths, sizes, hashes and counts only.
What it checks
- WordPress core – wp-admin, wp-includes and root files against the official checksums for your installed version.
- Plugins – each installed plugin against its WordPress.org checksums. Shows whether an update is available and what to do next in plain language.
- Uploads folder – PHP files and double extensions hiding in uploads, PHP tags inside non-PHP files, and common obfuscation patterns.
- Autoloaded code – mu-plugins and drop-ins (object-cache.php, advanced-cache.php and similar) that load without appearing in the admin plugin list.
- Config files – a hash and timestamp snapshot of wp-config.php and.htaccess, plus the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG. File contents are never read out.
- Administrator accounts – finds administrators hidden from the normal user list and capabilities granted outside a role.
Built to cut false positives
- Findings are ranked Critical or Review. A modified core or plugin file is Critical. An extra PHP file inside a plugin is Critical only when it contains suspicious code patterns; otherwise it is Review.
- Mark reviewed hides a file you have already checked. It reappears automatically if the file changes again.
- Plugins with a newer version available are flagged, so a mismatch caused by an outdated plugin points you to the update first.
Ways to run it
- The Quick Integrity Scanner admin screen: run a scan, view results, read the activity log.
- WP-CLI: wp mi-integrity scan-all
- A REST endpoint protected by an access token.
- Optional: an MCP connector so an AI assistant such as Claude can run the checks for you. It is off until you read the data-sharing notice and confirm it under Settings > Connectors. Scans never need it.
What it is not
Quick Integrity Scanner is a detection tool. It is not a firewall, a malware cleaner or a login protection plugin. org (no theme checksum API exists), and cannot see files outside the WordPress directory.
Use it alongside a firewall and backups.
Privacy and guardrails
- No file contents are returned, only ABSPATH-relative paths, hashes and counts.
- No remote access exists until you tick the data-sharing confirmation. Without it, no token can be created and the connector endpoints refuse requests.
- Scans are capped by file count and directory depth.
- No write, move or delete operations exist anywhere in the plugin.
- No data is sent to the plugin author. Nothing is collected or tracked.
External services
org API to download the official checksums it compares your files against:
- https://api.wordpress.org/core/checksums/1.0/ – core file checksums. Sent: your WordPress version and locale.
- https://downloads.wordpress.org/plugin-checksums/{plugin-slug}/{version}.json – plugin file checksums. Sent: the plugin folder name and installed version.
Responses are cached for 24 hours. org/about/privacy/
Optional: AI assistant connection
Off by default. Only if you tick the confirmation under Settings > Connectors and connect an assistant yourself, that assistant and its provider (for Claude, Anthropic) receive a text summary each time it runs a check. htaccess; paths of unusual files in the uploads folder; the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG; and the IDs and logins of administrators that look hidden or have unusual permissions.
It never contains file contents, passwords, email addresses, posts or database content. com/legal/privacy