Title: Integrity Sentinel Author: Bsidenet Published: August 24, 2026 Last modified: August 25, 2026 --- Search plugins ![](https://ps.w.org/integrity-sentinel/assets/banner-772x250.png?rev=3665781) ![](https://ps.w.org/integrity-sentinel/assets/icon.svg?rev=3664357) # Integrity Sentinel By [Bsidenet](https://profiles.wordpress.org/bsidenet/) [Download](https://downloads.wordpress.org/plugin/integrity-sentinel.1.14.4.zip) * [Details](https://wordpress.org/plugins/integrity-sentinel/#description) * [Reviews](https://wordpress.org/plugins/integrity-sentinel/#reviews) * [Installation](https://wordpress.org/plugins/integrity-sentinel/#installation) * [Development](https://wordpress.org/plugins/integrity-sentinel/#developers) [Support](https://wordpress.org/support/plugin/integrity-sentinel/) ## Description Integrity Sentinel provides WordPress administrators with a focused set of local security and integrity checks, optional vulnerability intelligence, login rate limiting, an administrative audit trail and frontend asset inventory. The plugin is designed to report verifiable conditions and useful indicators without treating every difference or heuristic match as proof of compromise. Key Features: * **WordPress Core Integrity:** Compares covered Core files with the official checksum manifest for the installed WordPress version and locale. *** Deep Plugin Integrity Scan:** Compares eligible WordPress.org plugins with checksums for the version actually installed, detecting modified, missing and unexpected files.*** PHP Heuristic Scan:** Looks for a limited set of suspicious obfuscation patterns and reports matches for manual investigation. Heuristic results can include false positives. * **Known Vulnerability Intelligence:** Optional integration with the public WPVulnerability API. When explicitly enabled, the plugin sends each plugin slug to WPVulnerability and compares the installed version locally with the affected version ranges returned by the service. * **Login Rate Limiting:** Temporarily blocks repeated failed login attempts using the IP address observed by the web server. *** Audit Trail:** Stores a bounded local history of selected administrative events such as successful logins and plugin activation/deactivation. * **Server and Configuration Checks:** Reviews HTTPS, debug exposure, security keys, selected HTTP headers, file permissions, PHP environment and other operational indicators. * **Update Monitoring:** Reports update information already maintained by WordPress for Core, plugins and themes. * **Frontend Asset Inventory:** Records the latest frontend scripts and styles observed while an administrator is viewing the public site. Query strings are not stored. * **Scheduled Scans and Email Alerts:** Optional scheduled audits with configurable alert thresholds and cooldowns. * **Structured Whitelist:** Supports explicit `plugin:`, `theme:`, `path:` and `file:` rules for heuristic exclusions. Integrity Sentinel does not guarantee that a site is free of malware or vulnerabilities. Checksum differences, heuristic matches and third-party vulnerability data should be reviewed in context. ### Privacy and External Services Integrity Sentinel stores operational data in the site’s own WordPress database. It does not include remote JavaScript, CSS or tracking pixels. Local data can include: * Plugin settings and the most recent scan results. * Bounded scan history and execution summaries. * A maximum of 100 recent audit events. These events can contain a username, action details, date/time and the IP address observed by the web server. * Temporary failed-login counters and temporary IP blocks. Entries expire after the configured internal protection window and are defensively capped.* The most recent frontend asset inventory generated while an administrator views the public site. The stored page URL does not include its query string. * A browser- local `wpis_coffee_hidden` preference can remember that an administrator dismissed the optional project-support card. It contains no account or site content. The plugin removes its stored options and scheduled event when it is uninstalled. A legacy backup-registry option from earlier development versions is also removed if present. Integrity Sentinel can contact the following external services when the related scan is requested or scheduled: 1. **WordPress.org Core Checksums API** – Service: https://api.wordpress.org/core/checksums/1.0/ – Purpose: Retrieves the official checksum manifest used to verify covered WordPress Core files. – Data sent in the request: Installed WordPress version and locale. Integrity Sentinel sets a neutral plugin User-Agent instead of the WordPress default site-identifying User- Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address. – Privacy policy: https://wordpress.org/about/privacy/ 1. **WordPress.org Plugin Checksum Service** – Service: https://downloads.wordpress.org/plugin-checksums/ – Purpose: Retrieves official file checksums for an installed WordPress.org plugin when the administrator starts the Deep Scan. – Data sent in the request: Plugin slug and installed plugin version in the request URL. Integrity Sentinel sets a neutral plugin User-Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address. – Privacy policy: https://wordpress.org/about/privacy/ 1. **WPVulnerability API — optional and disabled by default** – Service: https://www.wpvulnerability.com/ – API endpoint used: https://www.wpvulnerability. net/plugin/{plugin-slug}/ – Purpose: Provides public vulnerability records for WordPress plugins. – When contacted: Only when an administrator explicitly enables “External Vulnerability Intelligence” in Integrity Sentinel settings and runs, or schedules, the Updates/Vulnerabilities scan group. – Data sent by Integrity Sentinel: Plugin slug. The installed plugin version is compared locally and is not intentionally included in the WPVulnerability request. Integrity Sentinel sets a neutral plugin User-Agent. As with any HTTP connection, the destination service can observe the connecting server/proxy IP address. – API documentation: https://docs.wpvulnerability. com/ – Privacy information: https://www.wpvulnerability.com/privacy/ – License information: https://www.wpvulnerability.com/license/ No visitor content, passwords or administrator email addresses are intentionally transmitted by Integrity Sentinel to these services. ## Installation 1. Upload the `integrity-sentinel` folder to the `/wp-content/plugins/` directory, or install the ZIP through Plugins > Add New > Upload Plugin. 2. Activate Integrity Sentinel through the Plugins screen. 3. Open WP Integrity to run a manual audit. 4. Optional: open WP Integrity > Settings to enable scheduled scans, email alerts or external WPVulnerability intelligence. ## FAQ ### Does this plugin affect site performance? Most work only runs when an administrator starts a scan or when an explicitly enabled schedule fires. Filesystem scans and remote checksum/vulnerability requests can use CPU, disk I/O and network resources, so daily scheduling is recommended for most sites. ### Does a PASS result mean my site is completely secure? No. Integrity Sentinel verifies specific conditions and uses limited heuristics. A clean result cannot prove that a site has no malware, unknown vulnerability, compromised account or server-level issue. ### Why can a plugin show “official integrity unavailable”? Official plugin checksums are only available for eligible plugin versions published through WordPress.org. Private, custom or otherwise unsupported plugins can still receive the local heuristic scan, but Integrity Sentinel will not label their official integrity as verified. ### What whitelist formats are supported? Use one rule per line: `plugin:slug`, `theme:slug`, `path:relative/path/` or `file: relative/file.php`. Parent-directory traversal such as `../` is rejected. ### Is vulnerability intelligence enabled automatically? No. WPVulnerability integration is disabled by default. An administrator must explicitly enable External Vulnerability Intelligence in the plugin settings before those requests are made. ### Where can I get support? Visit https://bsidenet.com/code/integrity-sentinel/ or email info@bsidenet.com. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Integrity Sentinel” is open source software. The following people have contributed to this plugin. Contributors * [ Bsidenet ](https://profiles.wordpress.org/bsidenet/) [Translate “Integrity Sentinel” into your language.](https://translate.wordpress.org/projects/wp-plugins/integrity-sentinel) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/integrity-sentinel/), check out the [SVN repository](https://plugins.svn.wordpress.org/integrity-sentinel/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/integrity-sentinel/) by [RSS](https://plugins.trac.wordpress.org/log/integrity-sentinel/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.14.4 * Compatibility: Confirmed compatibility with WordPress 7.1. * UX: Added distinct Deep Scan result colours for INFO, attention, ERROR and successful verification lines to improve visual identification. * Maintenance: Updated release metadata and internal file headers for version 1.14.4. #### 1.14.3 * Compliance: Aligned the plugin header, internal file headers, Stable Tag and release metadata on version 1.14.3. * Compliance: Removed PHP HEREDOC/NOWDOC JavaScript and moved admin interactions to a local, human-readable `assets/js/admin.js` file. * Security: Added strict allowlist validation for scan groups, schedules, alert thresholds and Deep Scan plugin identifiers. * Security: Hardened Deep Scan path validation and containment to prevent traversal outside the installed plugins directory. * Security: Reworked login rate limiting to trust the server-observed `REMOTE_ADDR` by default, validate IP addresses, expire stale entries and cap stored entries defensively. * Security: Restored the appropriate native WordPress path constants and APIs for Core, content, plugins, themes, uploads and public-home paths. * Security: Removed disabled TLS certificate verification from HTTP checks. * Integrity: Deep Scan now requests WordPress.org checksums for the exact installed plugin version and separately reports modified, missing and unexpected files. * Integrity: Added correct handling for single-file plugins and incomplete filesystem scans. * Integrity: Core checksum differences are reported as conditions requiring investigation rather than proof of compromise. * Vulnerabilities: Replaced the previous hardcoded CVE demonstration with an optional WPVulnerability API integration and local installed-version comparison. * Privacy: External vulnerability intelligence is now disabled by default and requires explicit administrator opt-in; privacy documentation now covers external services, locally stored operational data and the browser-local support-card preference. * Privacy: External scanner requests use a neutral Integrity Sentinel User-Agent so the default WordPress site URL is not intentionally included in that header. * Performance: Removed forced plugin/theme update refreshes from every scan and removed the 15-minute full-scan schedule option. * Performance: Frontend asset inventory now uses WordPress path/URL APIs and stores the page URL without query parameters. * UX/Performance: Added a dashboard view for the latest administrator-observed frontend asset inventory, including handle, origin, size and source URL. * Reliability: Added defensive filesystem exception handling, scan limits, unreadable- file reporting and PHP 7.4-safe line detection without requiring `mbstring`. * Reliability: Deep Scan now resolves the plugin root correctly even when a plugin main file is nested below its root directory. * Accuracy: Reworded security checks and recommendations to avoid unsupported guarantees, false claims and security-theatre conclusions. * UX: Simplified the project-support card so it is directly dismissible without an additional modal prompt. * Scope: Removed current feature claims for unfinished backup, Smart Kill-Switch, WAF and one-click auto-fix functionality; historical changelog entries are retained for release history. * Cleanup: Uninstall now clears the scheduled scan hook and removes current plus legacy plugin options. #### 1.14.2 * Compliance: Replaced hardcoded ABSPATH and WP_CONTENT_DIR references with native, dynamic WordPress directory functions to ensure full compatibility with custom server environments, Symlinks, and WP.org directory guidelines. * Compliance: Removed all static `.po` and `.mo` language files from the plugin package to transition fully to the translate.wordpress.org collaborative localization system. #### 1.14.1 * Compliance: Replaced hardcoded ABSPATH references with native WordPress directory functions to ensure full compatibility with custom server environments and WP. org directory guidelines. #### 1.14.0 * New: Performance Module with Frontend Asset Tracking and Smart Kill-Switch. * Security: Refactored the backup system to use encrypted database storage, explicitly excluding wp-config.php to prevent salt leakage into the database. * Compliance: Added explicit Privacy & External Services documentation regarding the use of the WordPress.org API. * Fix: Removed unused core file inclusions and updated string matching functions for legacy PHP support. #### 1.13.1 * New: Asynchronous Deep Scan Engine (Anti-Timeout via AJAX). * New: Integration with WP.org API for cryptographic validation (Checksums). * New: Advanced heuristic engine indicating the exact line of malicious obfuscation. * Fix: Resolved a bug preventing Cron and Email settings from being saved correctly. #### 1.12.1 * Compliance update to meet official WordPress.org directory guidelines. * Renamed plugin slug and title to comply with WordPress trademark policies. * Improved security with strict output escaping (esc_html_e, esc_url) in the admin panel. #### 1.12.0 * Initial public release. ## Meta * Version **1.14.4** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [audit](https://wordpress.org/plugins/tags/audit/)[integrity](https://wordpress.org/plugins/tags/integrity/) [malware](https://wordpress.org/plugins/tags/malware/)[security](https://wordpress.org/plugins/tags/security/) [vulnerability](https://wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://wordpress.org/plugins/integrity-sentinel/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/integrity-sentinel/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/integrity-sentinel/reviews/) ## Contributors * [ Bsidenet ](https://profiles.wordpress.org/bsidenet/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/integrity-sentinel/)