Boot-Time Code Integrity in Laravel
SHA-256 hash-check a critical file on every Laravel boot and webhook a tamper alert — when the pattern helps on shared hosting, and the SSL/single-file limits to fix before you trust it.
App-layer auth does not catch “someone with shell access edited AppServiceProvider.php.” Boot-time integrity monitoring is a pragmatic answer when you do not control the OS.
Companion: PHP Ghost Wall.
Pattern
In booted(), hash a configured file, compare to an expected digest, POST an alert on mismatch, and optionally heartbeat on every clean boot so silence means outage.
Immediacy is the point: the first request after tampering fires before you wait for a nightly cron.
Limits to treat as bugs
- Skipping TLS verification on the alert POST invites MITM suppression of the warning
- Trusted install assumed — if the attacker sets the expected hash at deploy time, you are blind
- One file ≠ whole-tree FIM; full manifests are better but costlier at boot
- Prefer real FIM (AIDE/Tripwire/inotify) when you own the host
When to use it
Shared hosting, low-trust panels, institutional sites where you control the app but not the kernel. Pair with webhook deploys and a queue supervisor for a complete shared-hosting ops story.