The plugin runs scheduled checks and stores reports in the
WordPress database, where they can be viewed in the admin area. It includes:
- SHA-256 baseline hashing of relevant code files, with comparison during every scan
- Heuristic scanning for suspicious patterns commonly used in web shells and backdoors
- Detection of PHP files in writable directories, including uploads, cache, temporary folders, and similar locations
- A recently modified files list with a configurable time window
- Optional email notifications sent only when findings are detected
- Admin reports and actions for running a scan, recreating the baseline, and clearing reports
- Internationalization support, including a complete bg_BG translation
Admin page:
Dashboard → Tools → KC Site Audit
Install it as a standard plugin from a ZIP file:
upload it on the
"Add New Plugin" admin page, then activate it.
Upon activation, the plugin:
1) creates the initial baseline (if missing)
2) runs the first scan
3) schedules routine scans via WP-Cron based on your settings.
Go to
Dashboard → Tools → KC Site Audit and configure:
- Email notifications and the recipient address
- Routine scan frequency: hourly, twice daily, daily, weekly, or a custom interval in minutes
- The recently modified files window in days
- A hashing size limit in KB to reduce the load caused by large files
- The number of reports to retain
Recommended: for reliable scheduling, use a system cron job that calls wp-cron.php regularly, because WP-Cron depends on site traffic.
Q: Is this an antivirus? Will it remove malware automatically?
A: No. KC Site Audit is an early warning + integrity monitoring tool. It helps you detect suspicious changes quickly, but it does not automatically "clean" your site.
Q: I updated WordPress/plugins/themes and the baseline shows many changes. Is that normal?
A: Yes. Updates change files. After planned updates, use "Recreate baseline" once you confirm everything is clean.
Q: I see "PHP files in uploads/cache/tmp". Is this always malware?
A: Not always, but it is a strong warning sign. Most WordPress sites should not have executable PHP in uploads. Investigate each file.
Q: Will the scan slow down my site?
A: The plugin is designed to be lightweight. You can also cap hashing by file size and adjust scan frequency.
