Title: Quick Integrity Scanner Author: Medium Interactive Published: November 5, 2026 Last modified: November 5, 2026 --- Search plugins ![](https://ps.w.org/quick-integrity-scanner/assets/banner-772x250.png?rev=3786319) ![](https://ps.w.org/quick-integrity-scanner/assets/icon-128x128.png?rev=3786319) # Quick Integrity Scanner By [Medium Interactive](https://profiles.wordpress.org/mediuminteractive/) [Download](https://downloads.wordpress.org/plugin/quick-integrity-scanner.1.0.0.zip) * [Details](https://wordpress.org/plugins/quick-integrity-scanner/#description) * [Reviews](https://wordpress.org/plugins/quick-integrity-scanner/#reviews) * [Installation](https://wordpress.org/plugins/quick-integrity-scanner/#installation) * [Development](https://wordpress.org/plugins/quick-integrity-scanner/#developers) [Support](https://wordpress.org/support/plugin/quick-integrity-scanner/) ## Description Quick Integrity Scanner compares your site’s files against the official WordPress. org checksums and flags anything modified, missing or unexpected. It is built for agencies and site owners who want a fast, safe answer to one question: has anything on this site been changed that should not have been? Every check is read-only. The plugin never edits, moves or deletes a file, and it never sends file contents anywhere. It reports file paths, sizes, hashes and counts only. **What it checks** * **WordPress core** – wp-admin, wp-includes and root files against the official checksums for your installed version. * **Plugins** – each installed plugin against its WordPress.org checksums. Shows whether an update is available and what to do next in plain language. * **Uploads folder** – PHP files and double extensions hiding in uploads, PHP tags inside non-PHP files, and common obfuscation patterns. * **Autoloaded code** – mu-plugins and drop-ins (object-cache.php, advanced-cache. php and similar) that load without appearing in the admin plugin list. * **Config files** – a hash and timestamp snapshot of wp-config.php and .htaccess, plus the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG. File contents are never read out. * **Administrator accounts** – finds administrators hidden from the normal user list and capabilities granted outside a role. **Built to cut false positives** * Findings are ranked **Critical** or **Review**. A modified core or plugin file is Critical. An extra PHP file inside a plugin is Critical only when it contains suspicious code patterns; otherwise it is Review. * **Mark reviewed** hides a file you have already checked. It reappears automatically if the file changes again. * Plugins with a newer version available are flagged, so a mismatch caused by an outdated plugin points you to the update first. **Ways to run it** * The **Quick Integrity Scanner admin screen**: run a scan, view results, read the activity log. * **WP-CLI**: `wp mi-integrity scan-all` * A **REST endpoint** protected by an access token. * **Optional:** an MCP connector so an AI assistant such as Claude can run the checks for you. It is off until you read the data-sharing notice and confirm it under Settings > Connectors. Scans never need it. **What it is not** Quick Integrity Scanner is a detection tool. It is not a firewall, a malware cleaner or a login protection plugin. It does not scan the database, does not check themes against WordPress.org (no theme checksum API exists), and cannot see files outside the WordPress directory. Use it alongside a firewall and backups. **Privacy and guardrails** * No file contents are returned, only ABSPATH-relative paths, hashes and counts. * No remote access exists until you tick the data-sharing confirmation. Without it, no token can be created and the connector endpoints refuse requests. * Scans are capped by file count and directory depth. * No write, move or delete operations exist anywhere in the plugin. * No data is sent to the plugin author. Nothing is collected or tracked. ### External services This plugin contacts the WordPress.org API to download the official checksums it compares your files against: * `https://api.wordpress.org/core/checksums/1.0/` – core file checksums. Sent: your WordPress version and locale. * `https://downloads.wordpress.org/plugin-checksums/{plugin-slug}/{version}.json`– plugin file checksums. Sent: the plugin folder name and installed version. Responses are cached for 24 hours. Terms: https://wordpress.org/about/privacy/ #### Optional: AI assistant connection Off by default. Only if you tick the confirmation under Settings > Connectors and connect an assistant yourself, that assistant and its provider (for Claude, Anthropic) receive a text summary each time it runs a check. The summary contains: WordPress version and locale; relative paths of modified, missing or unexpected core and plugin files; plugin names, versions and update status; names, sizes, dates and MD5 hashes of mu-plugins, drop-ins, wp-config.php and .htaccess; paths of unusual files in the uploads folder; the status of DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and WP_DEBUG; and the IDs and logins of administrators that look hidden or have unusual permissions. It never contains file contents, passwords, email addresses, posts or database content. Anthropic’s terms: https://www.anthropic.com/legal/privacy ## Installation 1. Go to Plugins > Add New, search for Quick Integrity Scanner, and click Install Now, or upload the folder to /wp-content/plugins/. 2. Activate the plugin. 3. Open Quick Integrity Scanner in the admin menu and use the Run Scan tab. 4. Optional: to let an AI assistant run scans, open Settings > Connectors, read the data-sharing notice and confirm it, then generate a token. ## FAQ ### Is this an alternative to Wordfence or Sucuri? For the file integrity part, yes. It covers the same core and plugin checksum comparison, with a lighter footprint. It does not replace their firewall, malware signature database or cleanup services. ### Will it change or delete my files? No. The plugin has no write, move or delete operations. ### Will a plugin update trigger a false alert? Checksums are matched to your installed version, so a normal update does not. A mismatch usually means the plugin is outdated or a file was changed. The Results tab shows if an update is available. ### A flagged file is fine. How do I stop it showing up? Click Mark reviewed on the Results tab. Manage the list under Settings > Other Settings. ### Does it check themes? No. WordPress.org does not publish theme checksums. ### Does it scan outside the WordPress folder? No. It never reads outside the WordPress install. ### Do I need Claude or an AI assistant? No. Scans run from the admin screen on their own. The assistant connection is optional and off by default. ### What does connecting an assistant cost? The plugin is free. The assistant uses its own usage allowance (for Claude, your Claude plan). Files are never uploaded, so usage does not grow with site size. Each check returns a text summary, with lists capped at 200 paths. ### Do I need AI Copilot? No. It is optional. ### The scan stays Queued. Scans run through WP-Cron. If cron is disabled on your site (DISABLE_WP_CRON), the Run Scan tab shows a notice. Use Run Pending Checks Now there, or Force Run Now on the Results tab. ### Why are the default themes and Akismet not listed under core? The core checksum list also includes the bundled default themes and plugins. Many sites remove or replace them, so everything under wp-content is left out of the core check. Installed plugins are still checked in the plugin check. ### Claude does not see the tools. Start a new chat, or toggle the connector off and on in Settings > Connectors. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Quick Integrity Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ Medium Interactive ](https://profiles.wordpress.org/mediuminteractive/) [Translate “Quick Integrity Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/quick-integrity-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/quick-integrity-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/quick-integrity-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/quick-integrity-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/quick-integrity-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First official public release of Quick Integrity Scanner. ## Meta * Version **1.0.0** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.2 or higher ** * Tags * [audit](https://wordpress.org/plugins/tags/audit/)[checksums](https://wordpress.org/plugins/tags/checksums/) [File Integrity](https://wordpress.org/plugins/tags/file-integrity/)[malware](https://wordpress.org/plugins/tags/malware/) [security](https://wordpress.org/plugins/tags/security/) * [Advanced View](https://wordpress.org/plugins/quick-integrity-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/quick-integrity-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/quick-integrity-scanner/reviews/) ## Contributors * [ Medium Interactive ](https://profiles.wordpress.org/mediuminteractive/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/quick-integrity-scanner/)