What Is File Integrity Monitoring (FIM)?
Definition
File integrity monitoring (FIM) is the practice of recording a fingerprint (a cryptographic hash) of important files and alerting when any of them change, appear, or disappear unexpectedly. On a website or server, it is how you find out that someone modified your code, even when nothing looks wrong on screen.
How It Works
NIST's incident handling guide describes file integrity checking software this way: it "uses a hashing algorithm to obtain a cryptographic checksum for each designated file." When a file is altered and the checksum is recalculated, the new value will almost certainly not match. "By regularly recalculating checksums and comparing them with previous values, changes to files can be detected."
A working setup has four parts:
- A known-good baseline: hashes taken from a clean install, or from the official WordPress core and plugin releases.
- Scope: core files, plugins, themes,
wp-config.php,.htaccess, server configuration, and scripts loaded on checkout pages. - Regular comparison: scheduled or real-time checks. PCI DSS version 3.2.1, as quoted by the UK regulator below, asks merchants to compare critical files "at least weekly."
- Change review: each alert is matched to an approved update or treated as a possible intrusion.
FIM does not stop an attack. As the UK Information Commissioner's Office put it, it "allows the organisation to detect that changes have been made, and to establish whether they are unauthorised."
Real-World Example
Codecov, a code coverage tool used in software build pipelines, disclosed that beginning January 31, 2021, an attacker periodically altered its Bash Uploader script so it sent customers' environment variables, which can include credentials, tokens, and keys, to a server outside Codecov's infrastructure. According to Codecov's post-mortem, the incident was detected on April 1, 2021, when "a customer performing SHASUM checking on the Bash Uploader noticed a discrepancy" between the SHA256 hash published on GitHub and the one they calculated. Codecov told users that if they had run a checksum comparison before using the uploader, the issue "may not impact" them.
Why It Matters for a Small Business
Most website compromises change files: a webshell in the uploads folder, a redirect added to a theme, a skimmer appended to a checkout script. The ICO's 2020 penalty notice against British Airways said BA could have put in place measures to detect the kind of malicious action seen in its card-skimming attack, "in particular file integrity monitoring," and named the failure to put appropriate file integrity monitoring and event logging in place as the relevant failure. Small online stores that take cards are covered by PCI DSS too. FIM turns weeks of silent compromise into an alert the same day.
How to Spot It / How DTS Handles It
Signs you lack it: nobody can say which files changed last week, hacks are discovered by customers or Google, core files are never compared against official checksums, and checkout scripts change without anyone approving it.
DTS checks core and WordPress.org plugin files against official checksums (wp core verify-checksums, wp plugin verify-checksums), baselines themes and premium plugins from a known-clean copy, monitors for changes, and matches alerts to approved updates so only unexpected changes need review. See our WordPress care plans and the WordPress compromise checklist.
Related Terms
- Webshell: a file FIM should flag the moment it appears.
- Card skimmer (Magecart): the attack the ICO said FIM could have caught at British Airways.
- Backdoor: hidden code that changes files to keep access.
- Malware scanning: looks for known bad code, while FIM looks for any change.
- PCI DSS: the card standard that expects change detection.
- Supply chain attack: Codecov's altered script was one.
Sources
- NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012, superseded): https://csrc.nist.gov/pubs/sp/800/61/r2/final
- Codecov, Post-Mortem / Root Cause Analysis (April 2021): https://about.codecov.io/apr-2021-post-mortem/
- Codecov, Bash Uploader Security Update: https://about.codecov.io/security-update/
- UK Information Commissioner's Office, Penalty Notice: British Airways (October 16, 2020): https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf
Last updated October 14, 2026.