Daily monitoring
The standard integrity pass runs daily. Lockdown can add a separate hourly tripwire when enabled.
Free feature
File integrityyou can read
Files do not just change on their own. When a monitored WordPress file is modified, you want the path, the time and enough context to investigate.
What it does
File integrity
Core files are checked against WordPress.org checksums. Bearmor also keeps signatures for selected root PHP, wp-config.php, active-theme and MU-plugin files. Standard monitoring runs daily; plugin directories and uploads are not part of this integrity pass.
Core checksums
WordPress core is compared with the official WordPress.org checksum set.
Selected code files
Root PHP, wp-config.php, active-theme and MU-plugin files are tracked outside plugin directories.
Change details
See which monitored file changed and when, then investigate before taking action.
Quick quarantine
If something looks wrong, pull it out of rotation with one click. You can put it back.
Why it is there
What happens without it
An unexpected change in core, wp-config.php or the active theme can be an early sign of compromise. It can also be a legitimate update, which is why the path and context matter.
A few extra lines
They add a few lines to an existing file. Looks normal, works normal, but now there is a backdoor.
wp-config and login
Touch wp-config.php and they have database credentials. Modify wp-login.php and they capture passwords.
Checkout pages
A modified checkout page could copy card numbers somewhere else.
Was that an update
Did WordPress update, or did someone change the file? The record gives you a place to start.
This is targeted change detection, not a promise to monitor every file. A finding tells you what changed; it does not decide by itself whether the change is malicious.
A changed core file is often how we first notice a hack. Then we clean by hand.
Use Bearmor Security on your WordPress
Install the free plugin from WordPress.org. Every feature is free, with no paid plan to unlock.