Mail about warning for fike change always sent

I forgot: https://www.match2grow.it

@patm2g

Could you post the content of the email ?

It is correct that there is always a “File Changes Detected” entry added in the log. Even when there are no file changes detected.

dwinden

Here it is. Do you need the log (empty detail, however)
P.

Dear Site Admin,

The following is a summary of security related activity on your site. For details please visit the security logs

Lockouts: There have been no lockouts since the last email check.

File changes detected: iThemes Security detected file changes on your system.

This email was generated automatically by iThemes Security

To change your email preferences please visit the plugin settings.

@patm2g

Ok, so you are receiving the Daily Security Digest email instead of the File Change Warning email.

Temporarily disable the Digest email and see what happens then.

Please note you may risk receiving a lot more emails after disabling the Digest email.

dwinden

I’ve done. Until now I did’nt received any mail, may be the problem is only on the digest that is sent also w/o warning… I’ll keep this thread updated.

P.

Ok, when digest is disabled I receive the mail only if there was a change.
Is the use of the digest recommended only in case of attack?

P.

@patm2g

No. In general the digest email is intended to minimize the number of email notifications send by the iTSec plugin.
That said you will benefit most from it while your site is under (brute force) attack.

Note it will only affect email notifications triggered by the Brute Force Protection\404 Detection and\or File Change Detection features.

If there is no active host\user lockout and the last File Change Detection scan did not find any changes the Digest email is not send.

This is controlled by a specific option in the wp_options database table. It’s named itsec_message_queue. No message(s) in the queue means no digest email is send. The message queue is also emptied (initialized) after sending the latest Digest email.

Obviously there is something going wrong in your env that causes the message queue option to contain a file change detection message even when no file changes are detected.
I haven’t seen anyone else reporting a similar issue so I don’t think it’s a bug. Pretty sure this normally works as designed.

dwinden