Title: File changes warning Last modified: May 31, 2018 --- # File changes warning * [trentalor1138](https://wordpress.org/support/users/trentalor1138/) * (@trentalor1138) * [7 years, 10 months ago](https://wordpress.org/support/topic/file-changes-warning/) * I just received a notice from ithemes security stating that I had a massive file change on my site of up to 1500 files. * What should I do if I didn’t do this? * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Ffile-changes-warning%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 6 replies - 1 through 6 (of 6 total) * [nlpro](https://wordpress.org/support/users/nlpro/) * (@nlpro) * [7 years, 10 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10346650) * 1500 files changed, added or removed ? * Was the iTSec plugin recently updated ? * Thread Starter [trentalor1138](https://wordpress.org/support/users/trentalor1138/) * (@trentalor1138) * [7 years, 10 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10346669) * Module File Change Type Warning Description 12416 Added, 0 Removed, 0 Changed Timestamp 2018-05-31 10:23:37 User URL WP-Cron Scheduled Task * Is this normal? * I just been receiving a lot of ip attacks over the past two days, and this morning word-fence blocked me out, and I didn’t log in until yesterday. * I checked my e-mails, and there were 45 instances in which ip address were blocked due to attempts saying they were from me. * This file change freaked me out this morning. * [nlpro](https://wordpress.org/support/users/nlpro/) * (@nlpro) * [7 years, 10 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10346790) * I can understand an email like this can freak you out. But I think there is nothing to worry about. * My theory is that you recently updated the iTSec plugin which triggered a ‘first run’ File Change Detection scan. This due to the fact that in the latest iTSec plugin release (7.0.x) the File Change Detection scan engine code has totally been rewritten. * The feature should upgrade keeping old data but it looks like that didn’t happen. So after upgrading the plugin you got a typical ‘first run’ File Change Detection result. Whenever a File Change Detection scan runs for the first time in an env it will report a large amount of Added files (0 Removed, 0 Changed). * A File Change Detection scan will normally compare a (in the database) stored file list with what it just scanned. The first time there is no stored file list. So it has nothing to compare with. So all scanned files are reported as Added. * Just keep an eye on it. If the feature continues to report **12416 Added, 0 Removed, 0 Changed** files then it may be malfunctioning. Which could be another reason why this is happening. * [manik469](https://wordpress.org/support/users/manik469/) * (@manik469) * [7 years, 5 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10848291) * I have the same issue but when I check my files via FTP they are back dated. In short, it seem like itheme security is throwing incorrect message. * [maxlwie](https://wordpress.org/support/users/maxlwie/) * (@maxlwie) * [7 years, 4 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10876740) * Hello team, * I have been receiving similar messages. Over the last month or so the scans show that a large amount of files are added and then a later scan will show that they have been removed. Is this something to worry about? How do I know who is adding/ removing these files? * Thanks for the help. * [nlpro](https://wordpress.org/support/users/nlpro/) * (@nlpro) * [7 years, 4 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10876817) * Is there any error reported in the Apache (assuming Apache) error_log file ? * I’ve added the same response to your topic. Probably better to continue this in that topic… - This reply was modified 7 years, 4 months ago by [nlpro](https://wordpress.org/support/users/nlpro/). Viewing 6 replies - 1 through 6 (of 6 total) The topic ‘File changes warning’ is closed to new replies. * ![](https://ps.w.org/better-wp-security/assets/icon.svg?rev=2980272) * [Solid Security – Password, Two Factor Authentication, and Brute Force Protection](https://wordpress.org/plugins/better-wp-security/) * [Frequently Asked Questions](https://wordpress.org/plugins/better-wp-security/#faq) * [Support Threads](https://wordpress.org/support/plugin/better-wp-security/) * [Active Topics](https://wordpress.org/support/plugin/better-wp-security/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/better-wp-security/unresolved/) * [Reviews](https://wordpress.org/support/plugin/better-wp-security/reviews/) ## Tags * [file changes](https://wordpress.org/support/topic-tag/file-changes/) * 6 replies * 4 participants * Last reply from: [nlpro](https://wordpress.org/support/users/nlpro/) * Last activity: [7 years, 4 months ago](https://wordpress.org/support/topic/file-changes-warning/#post-10876817) * Status: not resolved