InTouch Integrity Guard

InTouch Integrity Guard is not a malware scanner and does not try to be one. It does a few focused things, all designed to run in the background without adding weight to a single front-end page load:

• Incremental file integrity checking. Compares WordPress core, plugin and theme files against known-good checksums from WordPress.org, and tracks your own file hashes locally so unchanged files are never re-hashed. Everything heavy runs in small batches via WP-Cron — never synchronously on a visitor’s request.
• Optional hardening toggles. Disable XML-RPC, block the file editor, hide the WordPress version, stop user enumeration (both the classic ?author=N probe and the REST API users endpoint), disable directory listing, send basic security response headers, and reduce automated bot noise against the login page — each one an independent, reversible switch, never forced on.
• Brute-force login protection. Blocks an IP after repeated failed logins, with configurable thresholds, backoff and a whitelist — checked with a single indexed query, before WordPress even attempts to verify a password. Optionally shows the country of each blocked IP (opt-in, requires your own free ipinfo.io token — see External services).
• Two-factor authentication. Opt-in per user: an authenticator app (TOTP), a one-time code emailed by your own site, or single-use backup codes. Administrators can require it for chosen roles with a grace period. Entirely local — the TOTP secret never leaves your database, and no third-party 2FA service is involved.
• Opt-in known-vulnerability alerts. Off by default. If you turn it on, a once-a-day check (never on a page load) compares your installed plugins, themes and core version against a public vulnerability database and emails you a digest if something needs attention. This is the plugin’s only feature that contacts a third-party service — see External services below.

InTouch Integrity Guard deliberately does not include a heuristic malware/YARA scanner, an always-on web application firewall, or automatic malware removal. If you need those, this is not the right tool — InTouch Integrity Guard is the lightweight layer that watches for unauthorized file changes and closes the easy doors, not a full security suite replacement.

Features:

• Incremental file integrity index (SHA-256, hash/mtime short-circuit so unchanged files are skipped)
• WordPress.org core and plugin checksum comparison, with orphan/unknown-file detection
• Batched, cron-driven scanning — never a blocking scan on page load
• Independent hardening toggles with automatic backup/restore of any file they touch
• Brute-force login protection with IP whitelist and reverse-proxy-aware IP detection
• Two-factor authentication: authenticator app (TOTP, RFC 6238), site-sent email codes, and ten single-use backup codes — the TOTP secret is stored encrypted and never transmitted
• Optional per-role two-factor enforcement with a configurable grace period; an administrator can reset a locked-out user’s second factor, and an SS_2FA_DISABLE constant is a site-wide escape hatch
• A hidden honeypot field on the login form, feeding into the same brute-force protection
• Optional custom login URL, to cut down on automated bot traffic against wp-login.php/wp-admin
• REST API user-enumeration blocking, alongside the classic ?author=N block
• Optional security response headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
• Opt-in daily known-vulnerability check (off by default) with a single digest email
• Admin dashboard with an aggregate security score, last-scan status, known vulnerabilities and 24-hour brute-force block count — the score and file-integrity counts refresh live while a scan runs, no manual reload needed
• Flagged-files list — every non-ok tracked file (modified, missing or unrecognized) with a paginated view, a read-only file content viewer, a direct link to the official plugin/theme/core source for comparison, and a CSV export for checking the list with external tools
• A commercial plugin sharing its free counterpart’s WordPress.org slug (a common pattern — e.g. a Pro edition installed under the free plugin’s folder name) is flagged as a likely different edition instead of flooding the list with unexplained “unrecognized” files, and doesn’t count against the security score
• Blocked IPs list — every IP currently blocked by brute-force protection, with a one-click unblock and a one-click “add to whitelist”

External services

Always active (core functionality):

• api.wordpress.org — used to retrieve the official checksum list for the installed WordPress core version, so the integrity scanner can tell an unmodified file from a genuinely changed one. The WordPress version and locale are sent when the checksum list is fetched (then cached locally for 24 hours). No personal or site-identifying data is sent. This host is operated by the WordPress project: terms / privacy.
• downloads.wordpress.org — used the same way, to retrieve checksums for installed plugins hosted on the WordPress.org Plugin Directory. Only the plugin slug and installed version are sent, and only for plugins that WordPress’s own update-check data already lists as wp.org-hosted; premium/custom plugins are never queried. This host is operated by the WordPress project: terms / privacy.

Opt-in, disabled by default:

• WPVulnerability API — used only to check your installed core, active plugins and active theme against a database of known vulnerabilities, and to email the site admin if a match is found.

  • Endpoint contacted: https://www.wpvulnerability.net/ — the public, key-less REST API. The service (API and policies alike) is operated by ROBOTSTXT (Barcelona, Spain); its policy pages are published on the company site wpvulnerability.com / robotstxt.es and cover this same API.
  • This is off by default. No request is made and nothing is scheduled until you explicitly enable it under InTouch Integrity Guard → Settings → Known-vulnerability check. You can disable it again at any time, which also clears any stored results.
  • What is sent, and when: once every 24 hours, via WP-Cron (never on a front-end page load), the plugin sends the component type (core, plugin or theme), the slug and the installed version number of each active component. No site URL, domain, IP address, admin email or other identifying data is sent, and no account or API key is required. Responses are cached locally for 12 hours.
  • Provider: ROBOTSTXT — privacy policy, terms / legal, FAQ.

• ipinfo.io — used only to look up the country of an IP address that brute-force login protection has actually blocked, shown on the Blocked IPs screen.

  • Endpoint contacted: https://api.ipinfo.io/lite/ (the “IPinfo Lite” country/ASN lookup).
  • This is off by default and needs your own token. No request is made until you both enable it and enter an API token under InTouch Integrity Guard → Settings → Brute-force protection. Tokens are free — get one at ipinfo.io/signup — and the plugin only ever uses the token you provide; it is never bundled with or shared by the plugin itself.
  • What is sent, and when: once an hour, via WP-Cron (never on a page load), for a small batch (up to 20) of IP addresses already recorded as blocked. Only the IP address and your token are sent — nothing about your site, and nothing about any visitor who was never blocked. The result (a two-letter country code, or nothing) is cached indefinitely on that row, so the same IP is never looked up twice.
  • Provider: IPinfo Inc. — privacy policy, terms of service.