Knowing when something happens.
WHAT TO MONITOR
File changes New user accounts Failed and successful logins Unexpected outbound activity Whether your site is reachable
WHY FILE MONITORING MATTERS
A compromise usually adds or modifies files.
Knowing when that happens is the earliest warning available.
WHAT PRODUCES ALERTS
A security plugin A monitoring service Server-level tools
WHAT TO ACT ON
Any change you did not make Any account you did not create Successful logins at unexpected times
THAT LAST ONE
The clearest single indicator of compromise.
WHAT ELSE TO CHECK PERIODICALLY
Your user list Your cron jobs Files in your upload directory Search results for your site, for injected content
THE SEARCH CHECK
Searching for your domain plus unrelated terms sometimes reveals injected spam pages.
WHERE TO SEND ALERTS
An address you monitor, not one hosted on the affected site.
