You can place the file checker outside the web directory and deny read/write permissions for the account that is running the web server. In other words do not allow the account running the web server to modify the file checker or the expected values for the file(s). Furthermore, make sure that the account running the web server does not have permissions to change the permissions of the file checker and expected values.
You could also do this from a remote machine, which runs the script and has the expected values, using either the Windows administrator shared folders (e.g. \PC\D$\www\file.php), or SSH on a Unix based system.
It comes down to permissions, as longest the account running the web server has the least permission required to run, and does not have permission to change the script file and expected values it will not render the file checker useless.
If you are interested on a heavy duty file integrity checker, for free, I recommend OSSEC.