Live file monitoring for web servers

Know the instant your
files are tampered with

HerdSecurity monitors every file on your web server using encrypted lightweight agents. Detect malware injection, backdoors, and ransomware, and optionally restore files automatically before damage is done.

  • RSA-2048 + AES-256-GCM, zero plaintext ever leaves your server
  • PHP, Docker, SSH daemon, and WordPress plugin agents
  • File Lock auto-revert, hard mode and framework-aware mode
  • Works on shared hosting, VPS, Docker, and WordPress
Create free account See how it works

No credit card required · Free forever on Individual plan · Open to all hosting environments

4
Agent tiers supported
RSA-2048
Encryption standard
5 min
Fastest scan interval
Free
Individual plan, forever

Everything you need to stay secure

All features are built on provably secure cryptography and operate without storing any of your file content in plaintext.

File Integrity Monitoring

Every file in your web root is hashed with SHA-256 and MD5 on every scan. Additions, modifications, and deletions are detected and classified. Supports path-based and pattern-based ignore rules to filter noise.

SHA-256 MD5 Ignore paths

End-to-End Encryption

Agents encrypt all scan results with your per-seal RSA-2048-OAEP public key. Private keys are stored in the database encrypted with AES-256-GCM. PHP Seal web requests are authenticated with HMAC-SHA256 and a 30-second replay window.

RSA-2048-OAEP AES-256-GCM HMAC-SHA256

File Lock, Automatic Revert

Enable File Lock to automatically revert any unauthorised change. Hard mode deletes new files and restores modified ones unconditionally. Framework-aware mode permits known CMS updates (e.g. WordPress upgrades) while blocking everything else.

Hard Lock Framework-aware WordPress-safe

Instant Email Alerts

Email alerts fire as soon as a change scan completes. Configure multiple alert contacts, set per-contact toggles for modified/added/deleted event types, and define maintenance mute windows to suppress false positives during planned deployments.

Multi-contact Mute windows Per-type toggles

Inline Diff Viewer

Every file change opens a side-by-side diff view with syntax highlighting (via highlight.js), so you can see exactly which lines were added, removed, or altered. Review PHP, JavaScript, HTML, CSS and more without leaving your browser.

Side-by-side Syntax highlight Line numbers

Agent Heartbeat Monitoring

HerdSecurity tracks the last time each agent checked in. If an agent goes silent, due to a server crash, network issue, or compromise, the dashboard alerts you within minutes, before an attacker can exploit the window.

Liveness checks Email on silence

Force Scan & Command Queue

Trigger an immediate scan from the dashboard at any time. PHP Seal supports instant direct push (no waiting for cron). Docker, SSH daemon, and WordPress plugin agents pick up commands via a secure poll queue, no inbound ports required.

Instant push Poll queue No open ports

File & Path Mute Manager

Silence alerts for individual files, directories, or glob patterns that change legitimately, such as session files, log rotations, or cache directories. Mute at the file level or set timed maintenance mute windows for your whole seal.

Per-file mute Glob patterns Timed windows

Scan History & Audit Log

Full scan history for every seal. Browse every past scan with file counts, change counts, and timestamps. Email notification log tracks every alert sent, useful for compliance reviews and incident investigation.

Scan history Email log Compliance-ready
Inline Diff Viewer

See exactly what changed, line by line

When a file change is detected, click to open the full diff viewer. Side-by-side panels show the before (baseline) and after (current) state of the file, with every changed line highlighted in red or green. Syntax highlighting works for PHP, JavaScript, HTML, CSS, JSON, and more.

  • Side-by-side or unified view
  • Highlight.js syntax colouring
  • Line-level additions and removals
  • Full file path and scan timestamp

Up and running in minutes

No infrastructure changes, no open inbound ports, no root access required on most setups.

Step 1

Install Agent

Upload a single PHP file, run our one-line bash install, deploy our Docker image, or install the WordPress plugin. Pick the tier that suits your hosting environment, shared host, VPS, or containerised.

Step 2

Connect Seal

Register your agent in the dashboard with a one-time install token. A unique RSA-2048 key pair is generated automatically for that seal, no manual key management required.

Step 3

Monitor Files

Your agent scans on your chosen schedule and posts RSA-encrypted results to HerdSecurity. Browse your file inventory, change history, and diffs directly from the dashboard.

Step 4

Auto-Lock (optional)

Enable File Lock to automatically revert any unauthorised change before it can cause damage, even while you sleep or are on holiday. Hard or framework-aware mode, your choice.

Four agent tiers, one for every environment

All agents use outbound-only connections (or direct push from your server). No inbound firewall rules or port forwarding needed.

Tier 1

PHP Seal

A single self-contained PHP file dropped in your web root. Dual-mode: instant web push (the dashboard calls your PHP file directly) or cron poll mode (PHP calls out on a schedule). Works on any shared hosting with PHP 7.4+.

Shared hosting compatible
Instant push or cron poll
File Lock supported
Tier 2

Docker Container

Mount your web root volume to the official herdsecurity/agent Docker image. Perfect for containerised deployments on Plesk, cPanel with Docker, or any bare-metal stack. Polls HerdSecurity via outbound HTTPS.

docker-compose ready
Outbound poll only
File Lock supported
Tier 3

SSH Daemon

Run one command over SSH: curl -s https://herdsecurity.co.uk/install.sh | bash. Creates a hardened Node.js systemd service that runs as a minimal-privilege user. Ideal for VPS and dedicated servers.

One-line install
systemd auto-start
File Lock supported
Tier 4

WordPress Plugin

Install directly from WP Admin. Uses wp_cron for scheduled scans and hooks into upgrader_process_complete to notify HerdSecurity of legitimate WordPress core, plugin, and theme upgrades, so File Lock doesn't revert them.

WP Admin upload
Upgrade-aware File Lock
wp_cron scheduling

Security architecture built without compromise

Every design decision in HerdSecurity prioritises the integrity of your data, and ours.

Data transmission security

  • RSA-2048-OAEP All scan results encrypted by the agent using your seal's public key. Only the HerdSecurity dashboard, which holds the private key, can decrypt them.
  • HMAC-SHA256 PHP Seal web-push requests are signed with a shared secret. A 30-second replay window prevents replay attacks.
  • One-time token Install tokens are nulled after the agent registers its first connection, they cannot be reused.

At-rest storage security

  • AES-256-GCM RSA private keys are stored in the database encrypted. An attacker who gained read access to the database would not be able to decrypt scan results without the encryption master secret.
  • bcrypt User passwords are stored using bcrypt with a cost factor of 12. Plaintext passwords are never stored or logged.
  • JWT revocation Session tokens are tracked server-side. Logging out or changing your password immediately invalidates all active sessions, including on other devices.

Simple, transparent pricing

Start free. Upgrade when you need more power. All plans include the full dashboard and all security features.

Individual
Free

No credit card required · free forever

  • 1 seal (monitored site)
  • PHP Seal agent (Tier 1)
  • Daily scans (24-hour interval)
  • Email alerts
  • Inline diff viewer
  • RSA-2048 encrypted scans
Get started free
Most Popular
Company
£19 /mo

Billed monthly · cancel any time

  • Up to 10 seals
  • All agent types (PHP, Docker, SSH, WordPress)
  • Hourly scans (60-minute min interval)
  • File Lock, hard & framework-aware modes
  • Multiple alert contacts
  • Maintenance mute windows
  • Force scan from dashboard
  • Email notification log
Start 14-day trial
Corporate
Contact

Custom pricing for agencies and large deployments

  • Unlimited seals
  • All agent types
  • 5-minute scan intervals
  • Priority support & SLA
  • On-premise deployment option
  • Custom scan paths & integrations
Get in touch

Frequently asked questions

Everything you need to know about how HerdSecurity works.

File integrity monitoring (FIM) means continuously checking that the files on your web server have not been altered without your knowledge. HerdSecurity's agents compute cryptographic hashes (SHA-256 and MD5) of every file at each scan, and compare them to a stored baseline. Any difference, whether a modification, a new file, or a deleted file, is flagged immediately.
No. Agents run as a background process outside your web request stack. The PHP Seal in cron mode runs independently of your web server. The SSH daemon and Docker container run as separate system services. No PHP or Node.js code is injected into your site's response path.
HerdSecurity receives file hashes (SHA-256 and MD5) for all files. For files modified or added, agents also send the file content for baseline storage and diff viewing, but only after encrypting it with your per-seal RSA-2048 public key. The HerdSecurity database stores private keys encrypted with AES-256-GCM; no file content is ever stored in plaintext.
A seal is a monitored site connection in HerdSecurity. Each seal has its own RSA key pair, agent configuration, file inventory, scan history, alert settings, and optional File Lock configuration. On the Individual plan you can have 1 seal; on the Company plan up to 10; on Corporate, unlimited.
Not if you use Framework-Aware mode. The WordPress plugin hooks into upgrader_process_complete to notify HerdSecurity of any WordPress core, plugin, or theme upgrade before it happens. HerdSecurity marks those file changes as expected, so File Lock allows them. Only unexpected changes (such as malware injection) are reverted.
You can create a maintenance mute window in the Alerts section of your seal dashboard. While a mute window is active, file changes are still detected and recorded, but email notifications are suppressed. You can also individually mute specific files or directory paths that change legitimately (such as log files or cache stores).
Yes, the PHP Seal (Tier 1) was specifically designed for shared hosting environments where you cannot install system services or run Docker. It is a single PHP file that requires only PHP 7.4+ and the openssl extension. No root access, SSH, or cron access is required in web-push mode.

Get in touch

Questions, enterprise quotes, WordPress agency pricing, or just want to say hello, we read every message.