Activity report does not list the majority of changed files

Hi @alamana , thanks for reaching out.

Can you please confirm the location of the modified files? Depending on the location of the modified files, head over to Wordfence>All Options>Scan Options>General Options and scroll down to confirm that these three options are enabled: 

• Scan core files against repository versions for changes
• Scan theme files against repository versions for changes 
• Scan plugin files against repository versions for changes

Additionally, make sure you have not included the directories that contain the modified files in the List of directories to exclude from the recently modified file list option under Wordfence>All Options>Activity Report.

Please note that the Recently Modified Files section in the Activity report only includes a maximum of the 10 recently modified files at the time the report is sent.

Let me know how it goes.

Thanks,

Mark. 

Hi Mark and thank you for your reply.

All of those options are checked and there are no directories excluded. I made changes to our custom theme files and they were not reported. This may be because at least 10 files change on the server most days and those may have pre-empted the changes I expected so see, but that seems improbable – and the limit of 10 files seems not particularly useful and might give users a false sense of security.

We use other mechanisms to detect unexpected changes but I always considered Wordfence more convenient for day-to-day checks, but the 10 file limit seems really easy for a malicious actor to work around by waiting until 10 other files have changed.

Thanks again.

You’re welcome @alamana.

I recommend reviewing the scan results daily or whenever you run a scan to review any modified file results.

Thanks,

Mark