Skip to main content

File Integrity

File Integrity​

Last verified: 2026-07-12

Awthy file-integrity scanning records display-safe evidence about changes under WordPress-owned roots. It is not a malware scanner, WAF, file cleaner, backup system, or guarantee that a site is clean.

Scan roots​

The default metadata scan roots are WordPress plugins, mu-plugins, and themes. Scan roots are stored as root families plus hashed/preview metadata, not absolute server paths. Core scanning is not currently enabled. Redacted diff evidence is narrower still: it is supported for eligible plugin and theme text files, while mu-plugin changes remain metadata-only.

Unsupported roots are skipped because arbitrary server paths can expose private infrastructure or unrelated application data.

Snapshot retention and redacted diffs​

When snapshot retention is enabled, Awthy can keep encrypted text snapshots for eligible files so future modified-file events can include encrypted redacted diff evidence. When retention is disabled, scans still record metadata-only changes and skip diff storage.

Diff eligibility is deliberately narrow. Redaction should remove secrets such as salts, private keys, bearer tokens, API keys, credential URLs, and payment/API secret prefixes before evidence is stored.

Partial scans are shown as partial evidence. When a traversal budget ends, Awthy does not call unseen files deleted. When hashing is unavailable or its byte budget is exhausted, an unknown hash is not treated as proof that a file changed and does not replace the last known hash.

Manager reporting uses bounded UTC periods and opaque cursor pages. A display-safe file reference can select one file's ordered change timeline without exposing its absolute server path.

CLI use​

Server operators can inspect redacted diff evidence through WP-CLI when browser access is unavailable:

wp awthy file-integrity diff <change-uuid> --format=json

Table output omits the redacted diff body; JSON is the deliberate evidence mode.

wp awthy rotate-key --dry-run and wp awthy rotate-key include encrypted retained snapshots and redacted diffs as well as authenticator secrets. Rotation uses bounded restartable batches. Keep the immediately previous key available until the dry run reports no remaining stale encrypted rows.

Boundaries​

  • No absolute server paths in UI or public docs evidence.
  • No raw unredacted file contents in audit rows.
  • No guarantee of malware detection or cleanup.
  • No off-site file-integrity telemetry unless managed reporting is entitled, enabled, and explicitly requested.
Last updated on