Hash-Check a Laravel File on Every Boot

Pick what to watch

Choose one high-value file — often app/Providers/AppServiceProvider.php — that an attacker would edit to inject code. Record its hash at a clean deploy:

sha256sum app/Providers/AppServiceProvider.php

Store that digest in .env as INTEGRITY_MONITOR_HASH.

[!CHECKPOINT] Baseline hash Compute the hash twice. They must match. Put the value in .env before writing any code.

Register a booted hook

public function boot(): void
{
    $this->app->booted(function () {
        $path = base_path(env('INTEGRITY_MONITOR_FILE_PATH'));
        $expected = env('INTEGRITY_MONITOR_HASH');
        $actual = hash_file('sha256', $path);

        if ($actual !== $expected) {
            $this->alertTamper($actual);
            return;
        }

        $this->heartbeat();
    });
}

booted() runs after providers are ready — HTTP facades work for the outbound POST.

Send evidence off-box

Local-only alerts die if the attacker also edits config. POST domain, IP, PHP/Laravel versions, git HEAD, and the bad digest to a server you control.

[!WARNING] Enable TLS verification on the alert client. Skipping it teaches attackers to MITM your only smoke alarm.

Prove it

1. Deploy clean, confirm heartbeat arrives
2. Edit one character in the watched file on the server
3. Hit any page — tamper alert should fire

[!CHECKPOINT] Negative test Restore the file, update the hash if needed, confirm heartbeats resume and alerts stop.

Graduate the pattern

For production hosts you own, prefer AIDE/Tripwire. For shared hosting, this pattern + queue workers + webhook deploys is a practical trio. Packaged form: PHP Ghost Wall.