File changes warning

1500 files changed, added or removed ?

Was the iTSec plugin recently updated ?

Module File Change
Type Warning
Description 12416 Added, 0 Removed, 0 Changed
Timestamp 2018-05-31 10:23:37
User
URL WP-Cron Scheduled Task

Is this normal?

I just been receiving a lot of ip attacks over the past two days, and this morning word-fence blocked me out, and I didn’t log in until yesterday.

I checked my e-mails, and there were 45 instances in which ip address were blocked due to attempts saying they were from me.

This file change freaked me out this morning.

I can understand an email like this can freak you out.
But I think there is nothing to worry about.

My theory is that you recently updated the iTSec plugin which triggered a ‘first run’ File Change Detection scan. This due to the fact that in the latest iTSec plugin release (7.0.x) the File Change Detection scan engine code has totally been rewritten.

The feature should upgrade keeping old data but it looks like that didn’t happen.
So after upgrading the plugin you got a typical ‘first run’ File Change Detection result.
Whenever a File Change Detection scan runs for the first time in an env it will report a large amount of Added files (0 Removed, 0 Changed).

A File Change Detection scan will normally compare a (in the database) stored file list with what it just scanned. The first time there is no stored file list. So it has nothing to compare with. So all scanned files are reported as Added.

Just keep an eye on it. If the feature continues to report 12416 Added, 0 Removed, 0 Changed files then it may be malfunctioning. Which could be another reason why this is happening.

I have the same issue but when I check my files via FTP they are back dated. In short, it seem like itheme security is throwing incorrect message.

Hello team,

I have been receiving similar messages. Over the last month or so the scans show that a large amount of files are added and then a later scan will show that they have been removed. Is this something to worry about? How do I know who is adding/removing these files?

Thanks for the help.

Is there any error reported in the Apache (assuming Apache) error_log file ?

I’ve added the same response to your topic. Probably better to continue this in that topic…

• This reply was modified 6 years ago by nlpro.