Quick Integrity Scanner

Quick Integrity Scanner compares your site’s files against the official WordPress.org checksums and flags anything modified, missing or unexpected. It is built for agencies and site owners who want a fast, safe answer to one question: has anything on this site been changed that should not have been?

Every check is read-only. The plugin never edits, moves or deletes a file, and it never sends file contents anywhere. It reports file paths, sizes, hashes and counts only.

What it checks

• WordPress core – wp-admin, wp-includes and root files against the official checksums for your installed version.
• Plugins – each installed plugin against its WordPress.org checksums. Shows whether an update is available and what to do next in plain language.
• Uploads folder – PHP files and double extensions hiding in uploads, PHP tags inside non-PHP files, and common obfuscation patterns.
• Autoloaded code – mu-plugins and drop-ins (object-cache.php, advanced-cache.php and similar) that load without appearing in the admin plugin list.
• Config files – a hash and timestamp snapshot of wp-config.php and .htaccess, plus the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG. File contents are never read out.
• Administrator accounts – finds administrators hidden from the normal user list and capabilities granted outside a role.

Built to cut false positives

• Findings are ranked Critical or Review. A modified core or plugin file is Critical. An extra PHP file inside a plugin is Critical only when it contains suspicious code patterns; otherwise it is Review.
• Mark reviewed hides a file you have already checked. It reappears automatically if the file changes again.
• Plugins with a newer version available are flagged, so a mismatch caused by an outdated plugin points you to the update first.

Ways to run it

• The Quick Integrity Scanner admin screen: run a scan, view results, read the activity log.
• WP-CLI: wp mi-integrity scan-all
• A REST endpoint protected by an access token.
• Optional: an MCP connector so an AI assistant such as Claude can run the checks for you. It is off until you read the data-sharing notice and confirm it under Settings > Connectors. Scans never need it.

What it is not

Quick Integrity Scanner is a detection tool. It is not a firewall, a malware cleaner or a login protection plugin. It does not scan the database, does not check themes against WordPress.org (no theme checksum API exists), and cannot see files outside the WordPress directory. Use it alongside a firewall and backups.

Privacy and guardrails

• No file contents are returned, only ABSPATH-relative paths, hashes and counts.
• No remote access exists until you tick the data-sharing confirmation. Without it, no token can be created and the connector endpoints refuse requests.
• Scans are capped by file count and directory depth.
• No write, move or delete operations exist anywhere in the plugin.
• No data is sent to the plugin author. Nothing is collected or tracked.

External services

This plugin contacts the WordPress.org API to download the official checksums it compares your files against:

• https://api.wordpress.org/core/checksums/1.0/ – core file checksums. Sent: your WordPress version and locale.
• https://downloads.wordpress.org/plugin-checksums/{plugin-slug}/{version}.json – plugin file checksums. Sent: the plugin folder name and installed version.

Responses are cached for 24 hours. Terms: https://wordpress.org/about/privacy/

Optional: AI assistant connection

Off by default. Only if you tick the confirmation under Settings > Connectors and connect an assistant yourself, that assistant and its provider (for Claude, Anthropic) receive a text summary each time it runs a check. The summary contains: WordPress version and locale; relative paths of modified, missing or unexpected core and plugin files; plugin names, versions and update status; names, sizes, dates and MD5 hashes of mu-plugins, drop-ins, wp-config.php and .htaccess; paths of unusual files in the uploads folder; the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG; and the IDs and logins of administrators that look hidden or have unusual permissions. It never contains file contents, passwords, email addresses, posts or database content. Anthropic’s terms: https://www.anthropic.com/legal/privacy