# How To Record Host File Changes With BetterShield?

Record a known plugin or theme deployment outside WordPress's updater, or accept a reviewed host-written file, with WP-CLI.

With **[BetterShield](/)**, record a known plugin or theme deployment outside WordPress's updater, or accept a reviewed host-written file, with WP-CLI.

_**Note:** These commands require WP-CLI access and BetterShield 1.1.5 or newer. Choose the action that matches your deployment; recording an update and accepting one file are separate operations._

## What it does

Free 1.1.5 adds two WP-CLI actions for hosts and deployment tools. One records a known plugin or theme update that happened outside WordPress's updater. The other accepts a reviewed file the host wrote as its expected state.

Neither action verifies who wrote the code or whether it is safe. Use a deployment record and a trusted package to confirm the change first.

<span id="record-a-plugin-or-theme-update" aria-hidden="true"></span>

## Step 1: Record a Known Deployment

After a known deployment, name the installed folder and exact version:

```sh
wp bettershield integrity record-update --slug=your-plugin --version=1.2.3 --user=admin
wp bettershield integrity record-update --type=theme --slug=your-theme --version=1.2.3 --user=admin
```

The component must have an earlier recorded copy and a version that actually changed. A different version on disk, an unchanged version or a missing baseline is refused. The next file check reads the recorded change as an update.

Already reported file changes stay open. Review them separately with [Expected file changes](/docs/expected-file-changes/). A component with published checksums remains checked against its published copy.

<span id="record-one-host-written-file" aria-hidden="true"></span>

## Step 2: Accept a Reviewed Host File

Use the path from the site root, as File Changes names it:

```sh
wp bettershield integrity expect-file --file=.htaccess --user=admin
```

This records the current readable file as expected and prints an undo token. It applies to eligible watched must-use plugins, drop-ins, configuration files and plugins without a published copy. Theme files are not accepted by this action. An official file compared with published checksums cannot be accepted this way.

## Recommended settings

Add the appropriate command after a successful, verified deployment. Keep its result with the deployment record. If a command refuses the change, read the reason before continuing. Do not accept unrelated files just to clear the report.

## What it can break and how to undo

Accepting an unknown file can hide that exact change. A later modification is still reported. To undo a recorded expected file, use the printed token:

```sh
wp bettershield integrity undo --token=<token> --user=admin
```

Undo restores the prior comparison state. It does not put earlier file contents back. A recorded update is an activity record; use your deployment system to roll the installed code back when necessary.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

Run a file check, read its completion status, and review File Changes and the activity log. Existing unresolved changes require their own review even after an update is recorded.

## Related

- [File integrity checks](/docs/file-integrity-checks/)
- [Expected file changes](/docs/expected-file-changes/)
- [Host-managed alerts](/docs/host-managed-alerts/)
- [WP-CLI commands](/docs/wp-cli-commands/)

This is how you can record verified host deployments and expected files with BetterShield’s WP-CLI commands.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).