by
intouchdesigndev
5 (1 reviews)
InTouch Integrity Guard
A lightweight file integrity checker, hardening toggles and opt-in known-vulnerability alerts — built to never slow your site down.
InTouch Integrity Guard ranks #31,576 among WordPress.org plugins with 10+ active installations, is #2,394 of 4,566 in the Security category, a 5/5 rating from 1 reviews, and was last updated Sep 5, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v1.1.1
Current Version v1.1.1
Updated 2 weeks ago
Last Update on 05 Sep, 2026
Refreshed 8 hours ago
Last Refreshed on
#2,394 of 4,566 in Security
Actively maintained
Rank
#31,576
—
No change
Active Installs
10+
-4%
KW Avg Position
103
29 better
Downloads
206
+3 today
Support Resolved
0%
—
No change
Rating
100%
Review 5 out of 5
5
(1 reviews)
Next Milestone 20
10+
20+
20,834
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 4 more installs to reach 20+
Rank Changes
Current
#31,576
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
1 reviews
Overall
100%
5
1
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.1
- Last Updated
- Sep 05, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1
- PHP Version
- 7.4 or higher
- Author
- intouchdesigndev
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 1
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,758
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,008
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about InTouch Integrity Guard
No. It tells you which files changed or don't match the official WordPress.org checksums, and lets you decide what to do next. It does not scan file contents for malicious patterns and does not remove anything automatically.
By default it only contacts api.wordpress.org / downloads.wordpress.org to fetch official checksums (WordPress version and locale, plus wp.org-hosted plugin slugs/versions — no identifying data). The known-vulnerability check that contacts wpvulnerability.net, and the optional country lookup that contacts ipinfo.io, are both off by default and only run if you enable them in Settings; see External services above for exactly what each sends.
The integrity scan and the optional vulnerability check both run exclusively via WP-Cron, in small batches, and never on a normal front-end page load. Hardening toggles and brute-force checks are lightweight, indexed operations.
Nothing is sent anywhere. Each user turns on their own second factor under Users → Two-factor authentication: an authenticator app (standard TOTP — Google Authenticator, Aegis, 1Password, etc.), a 6-digit code emailed by your own site with wp_mail(), or a set of ten single-use backup codes. The authenticator secret is generated on your server, stored encrypted in the database, and never transmitted. There is no external 2FA service, no API key, and no account to create.
Any administrator can clear your second factor from Users → (your account) → Manage this user's two-factor authentication → Reset, after which you can sign in with just your password and set it up again. If every administrator is locked out, add define( 'SS_2FA_DISABLE', true ); to wp-config.php to switch off all 2FA prompts and enforcement site-wide, sign in, sort it out, then remove the line. As a last resort, wp user meta delete <user> _ss_2fa_enabled_methods via WP-CLI does the same for one account.
Yes. Once a user has a second factor, logging in as that user with their password over xmlrpc.php or via HTTP Basic auth on the REST API is refused — those channels never present the second factor, so allowing them would defeat it. Application passwords (Users → Profile → Application Passwords) keep working: each is a separate, individually revocable token, which is the right way to give a script or app access to a 2FA-protected account.
Yes. Under InTouch Integrity Guard → Settings → Two-factor authentication, enable it and tick the roles it should be mandatory for, with a grace period (in days) before it is enforced. Affected users who have not set up a second factor are sent to the setup page once their grace period ends and cannot reach the rest of wp-admin until they do; logging out always stays available. It is off, with no roles enforced, by default.
Multisite is not supported in this version. The plugin will not fatal if activated network-wide, but its functionality is not adapted for a multisite context yet.
Be honest with yourself about what this does: it reduces automated bot noise against the standard wp-login.php/wp-admin paths — nothing more. It is not a real security boundary. Anyone who wants to find your actual login URL can, by other means, and this does not replace (and is not a substitute for) the brute-force protection above, which is what actually stops credential-guessing attacks. Think of it as cutting down on log noise and drive-by bot traffic, not as locking a door. This feature is implemented purely as PHP code that runs while the plugin is active — it never writes a rewrite rule or any other change to .htaccess or your server configuration. That means deactivating the plugin, or even just removing its files directly (FTP, your host's file manager, without going through the WordPress admin at all), immediately restores the standard wp-login.php/wp-admin URLs on the very next request. There is no separate cleanup step, and no scenario where this feature can lock you out of your own site once the plugin itself is gone.
WordPress's built-in "WP-Cron" only fires when someone visits the site, so a low-traffic site can see scans lag behind schedule. The scan cycle is a self-resuming chain — a missed tick just means the next visit (or the next real cron trigger) picks up exactly where it left off, nothing is lost or duplicated — but if you want scans to run on a predictable schedule regardless of traffic, disable WordPress's page-load-triggered cron and drive it with a real system cron job instead: Add define( 'DISABLE_WP_CRON', true ); to wp-config.php. Add a system cron job (via your host's control panel, or crontab) that requests wp-cron.php on a schedule, e.g. every 5 minutes: */5 * * * * curl -s https://yoursite.example/wp-cron.php >/dev/null 2>&1 or, if WP-CLI is available on your server: */5 * * * * cd /path/to/wordpress && wp cron event run --due-now >/dev/null 2>&1 This is standard WordPress practice, not something specific to this plugin — any WP-Cron-dependent plugin benefits from it on a low-traffic site.
