InTouch Integrity Guard
Lightweight file integrity checks, hardening, and vulnerability alerts for WordPress, without slowing your site down.
InTouch Integrity Guard adds file integrity checking, optional hardening, brute-force login protection, and known-vulnerability alerts to WordPress, and keeps all four light. It is not a malware scanner: instead of scanning for signatures, it checks your core, plugin, and theme files against WordPress.org's official checksums and flags the ones that don't match. Every scan runs in small WP-Cron batches, never on a page load, and re-checks only the files that changed since last time, so a busy site doesn't feel it. Hardening is opt-in and reversible, every toggle off by default, and the plugin backs up any .htaccess change for one-click rollback. A single dashboard carries the security score, last-scan status, open vulnerabilities, and the 24-hour brute-force block count, with a per-file list you can inspect, compare against the official source, and export to CSV.
How It Works
- 1
Scan
Core, plugin, and theme files are hashed in small WP-Cron batches and checked against WordPress.org's official checksums, so only new or changed files are ever re-hashed.
- 2
Harden
Turn on the protections you want: disable XML-RPC, block the file editor, stop user enumeration, and more. Every toggle is independent, reversible, and off by default.
- 3
Protect
Failed logins are counted per IP and blocked with escalating backoff before WordPress checks the password, with a honeypot field and a whitelist for trusted IPs.
- 4
Alert
A daily check compares your plugins, themes, and WordPress version against public vulnerability databases and sends a single digest email if anything is found.
Compatibility
- WordPress 6.2 or higher (tested on 7.1, and on 6.9.7, the latest of the previous major line)
- PHP 7.4 or higher (tested on 7.4, 8.1, 8.2, and 8.3)
Key Features
- File integrity checking against WordPress.org's official checksums
- Local hash and modification-time tracking: only new or changed files are re-hashed
- All scanning runs in small WP-Cron batches, never on page load
- Optional, fully reversible hardening: every toggle off by default
- Brute-force login protection with escalating backoff and an IP whitelist
- Daily known-vulnerability alerts, delivered as one digest email
- Security dashboard with a live aggregate score and per-file detail
File Integrity Checking
- Compares core, plugin, and theme files against WordPress.org's official checksums, telling a modified file apart from one that's "unknown" to the local index
- Tracks file hashes and modification times locally: unchanged files are never re-hashed, only new or changed ones are
- All the heavy lifting runs in small batches via WP-Cron, never synchronously while a visitor is loading a page
- A separate edition of another plugin installed under that plugin's WordPress.org folder name is flagged as a likely different build instead of flooding the list with false alarms, and doesn't count against the security score
Optional Hardening
- Disable XML-RPC, block the file editor, hide the WordPress version, stop user enumeration (both the classic ?author=N probe and the REST API users endpoint), disable directory listing, send basic security response headers
- Every toggle is independent, reversible, and off by default; the administrator decides
- The plugin backs up any change to .htaccess, and you can restore it with one click
Brute-Force Login Protection
- Blocks an IP after a configurable number of failed login attempts, with escalating backoff on repeat offenders and a whitelist for trusted IPs
- Checked with a single indexed query, before WordPress even attempts to verify a password
- A hidden honeypot field on the login form feeds into the same blocking system
- An optional custom login URL cuts down on automated bot traffic against wp-login.php / wp-admin; it reduces noise, but does not replace the brute-force protection above, which is what stops credential-guessing attacks
Known-Vulnerability Alerts
- A daily check (never on page load) compares installed plugins, themes, and the WordPress version against public vulnerability databases
- A single digest email if something is found, never one email per vulnerability
Dashboard and Verification Tools
- An aggregate security score, last-scan status, known vulnerabilities, and 24-hour brute-force block count; the score and file-integrity counts update live while a scan runs, no manual reload needed
- A list of individually flagged files (modified, missing, or unrecognized) with a read-only content viewer, a direct link to the official source for comparison, and a CSV export for checking the list with external tools
- A list of currently blocked IPs, with one-click unblock and one-click "add to whitelist"
External Services Used
InTouch Integrity Guard contacts three external services, only to run its checks. It sends no personal or site-identifying data, and needs no API key.
api.wordpress.org
Official checksums for the installed core version. Only the version and locale are sent; no personal data.
downloads.wordpress.org
Checksums for plugins hosted on WordPress.org. Only the slug and version are sent, and never for paid or custom plugins.
wpvulnerability.net
Daily known-vulnerability check. Only component type, slug, and version are sent; no site-identifying data, and no API key required.
FAQ
Is InTouch Integrity Guard a malware scanner?
No. A malware scanner matches your files against a database of known-bad signatures. InTouch Integrity Guard works the other way round: it compares core, plugin, and theme files against WordPress.org's official checksums and reports which ones don't match, so it catches an unexpected change even when no signature for it exists yet. It flags files for you to review; it doesn't name threats or quarantine them.
Will it slow down my site?
It's built not to. The file scan is the only heavy job, and it runs a handful of files at a time on WP-Cron, re-hashing only what changed since the last pass. The vulnerability check runs once a day. The brute-force lookup is a single indexed query that happens before WordPress even starts checking the password. None of it touches a normal page request.
Does the optional custom login URL replace brute-force protection?
No. A custom login URL only reduces automated bot traffic against wp-login.php and wp-admin; it cuts down on noise. The brute-force protection (IP blocking with escalating backoff, plus the login honeypot) is what stops credential-guessing attacks.
What data leaves my site?
Only what each check needs: core version and locale to api.wordpress.org, plugin slug and version to downloads.wordpress.org (never for paid or custom plugins), and component type, slug, and version to wpvulnerability.net. No personal or site-identifying data, and no API key required.
Free and open source. Install it straight from your WordPress dashboard, or download it from WordPress.org.
Get it on WordPress.org