How To Record Host File Changes With BetterShield?
Record a known plugin or theme deployment outside WordPress's updater, or accept a reviewed host-written file, with WP-CLI.
With BetterShield, record a known plugin or theme deployment outside WordPress’s updater, or accept a reviewed host-written file, with WP-CLI.
Note: These commands require WP-CLI access and BetterShield 1.1.5 or newer. Choose the action that matches your deployment; recording an update and accepting one file are separate operations.
What it does
Free 1.1.5 adds two WP-CLI actions for hosts and deployment tools. One records a known plugin or theme update that happened outside WordPress’s updater. The other accepts a reviewed file the host wrote as its expected state.
Neither action verifies who wrote the code or whether it is safe. Use a deployment record and a trusted package to confirm the change first.
Step 1: Record a Known Deployment
After a known deployment, name the installed folder and exact version:
wp bettershield integrity record-update --slug=your-plugin --version=1.2.3 --user=admin
wp bettershield integrity record-update --type=theme --slug=your-theme --version=1.2.3 --user=admin
The component must have an earlier recorded copy and a version that actually changed. A different version on disk, an unchanged version or a missing baseline is refused. The next file check reads the recorded change as an update.
Already reported file changes stay open. Review them separately with Expected file changes. A component with published checksums remains checked against its published copy.
Step 2: Accept a Reviewed Host File
Use the path from the site root, as File Changes names it:
wp bettershield integrity expect-file --file=.htaccess --user=admin
This records the current readable file as expected and prints an undo token. It applies to eligible watched must-use plugins, drop-ins, configuration files and plugins without a published copy. Theme files are not accepted by this action. An official file compared with published checksums cannot be accepted this way.
Recommended settings
Add the appropriate command after a successful, verified deployment. Keep its result with the deployment record. If a command refuses the change, read the reason before continuing. Do not accept unrelated files just to clear the report.
What it can break and how to undo
Accepting an unknown file can hide that exact change. A later modification is still reported. To undo a recorded expected file, use the printed token:
wp bettershield integrity undo --token=<token> --user=admin
Undo restores the prior comparison state. It does not put earlier file contents back. A recorded update is an activity record; use your deployment system to roll the installed code back when necessary.
Final Outcome
Run a file check, read its completion status, and review File Changes and the activity log. Existing unresolved changes require their own review even after an update is recorded.
Related
This is how you can record verified host deployments and expected files with BetterShield’s WP-CLI commands.
Getting Stuck? Feel free to contact our Dedicated Support Team.