File Integrity Monitoring SOP

File Integrity Monitoring SOP
Know the instant a file changes that shouldn't.

— Step 1: Establish a baseline — hash every file in core, themes, and plugins after a clean deploy.
— Step 2: Store the baseline off-host; an attacker who edits files will also edit a local manifest.
— Step 3: Schedule a daily diff: any changed, added, or deleted file in core triggers an alert.
— Step 4: Whitelist legitimate write paths (uploads/, cache/) to cut noise — but still log them.
— Step 5: Compare WordPress core against official checksums via wp core verify-checksums.
— Step 6: Route alerts to a channel a human actually watches.
— Verify: touch a core file and confirm the alert fires within the cycle.

Run this every time.