Integrity Monitoring
Verify WordPress core and plugins against checksums, baseline other files, and flag dangerous uploads.
What it does
Integrity compares core and WordPress.org plugins to official checksums, baselines themes and custom files, and flags PHP (and double-extension) files in uploads. Standard WordPress directory-blocker index.php files (content-verified silence or die/exit stubs) are not flagged; other PHP under uploads still is.
How it works
Use Scan → Run Integrity suite or the Integrity tab. Jobs run in the background under a time/memory budget. Accept baseline changes when you recognize them.
Settings
No dedicated Settings keys beyond scan controls on the Integrity and Scan tabs.
What findings mean
Kinds such as core.modified, plugin.*, baseline.changed, and uploads.dangerous appear in Findings / Events.
Recommended action
Restore tampered core/plugin files from a trusted source. Accept intentional baseline changes. Remove executable uploads. A silence index.php used only to block directory listing is expected and safe when its contents match the known stub patterns.