File Integrity Monitoring

Signature-based scanning only catches content matching a known pattern. A payload hand-inserted into an already-trusted file can dodge every signature check while still being a real backdoor. File Integrity Monitoring catches that class of compromise instead.

How it works

• Create Baseline -- one click hashes every scanned file with SHA-256 and stores it as your site's known-good snapshot.
• Check Integrity Now -- re-hashes and compares against the baseline on demand, or automatically as part of a scheduled check.
• Narrow, high-signal -- only files present in both the baseline and the current scan, with a different hash, are reported. A brand-new file is left to the regular scanner's own checks.
• Never auto-updates -- the baseline only moves forward when you explicitly rebuild it, since a legitimate update changes files too.

Drift found during a scheduled check rides the exact same email/Slack/Discord/Telegram alert as a signature-based finding -- there's no separate notification habit to learn. It's flagged at Medium confidence by design, since a legitimate extension update also changes files and this can't tell the difference from tampering on its own.