wordfence
Feature: First Scan, Incremental Scan and On-demand Scan
Has there been any thought to implementing a method to complete a scan on a directory and generate a cache or database fingerprinting the file so that an incremental scan can be done only on modified files?
Furthermore, would it be possible to implement hooking into inotify and scanning files on demand that are modified or created and have wordfence-cli run as a daemon?
Wordfence CLI has been designed to be flexible enough to integrate with other standard Linux utilities. This should allow you to accomplish most of what you're describing with the current release.
Fingerprinting files would involve actually reading and hashing the files which is a fairly expensive operation in itself. Instead, using the ctime property of the file is generally more practical. Since this is already tracked by the filesystem, it's simple enough to scan only files modified since the last scan using something like find. There's an example in the documentation.
Regarding inotify, there is an inotifywait utility that could potentially be used in conjunction with Wordfence CLI to scan modified files in real time. We don't have an example in the documentation currently, as issue #231 (which will be addressed in an upcoming CLI release) currently prevents this from working as intended.
We have previously discussed implementing a daemon mode for CLI as well as an integration with inotify, but determined that neither was necessary with the way CLI can already be integrated with other utilities. We will discuss this further internally as a potential future enhancement, though I can't commit to implementing it or a timeline at this point. Thanks for the suggestions!
Closing this case out, utilizing some of the suggestions Alex outlined should accomplish what you are looking for.
