iThemes has detected file changes

Assuming you are referring to the following msg:

iThemes Security has noticed a change to some files in your WordPress site. Please review the logs to make sure your system has not been compromised.

View Logs Dismiss Warning

The file change warning is only displayed when doing a manual file change detection scan (= Click on the blue Scan Files Now button in the File Change Detection section of the Settings page).

Also if you disable the Display File Change Admin Warning
setting the warning will not be displayed.

A scheduled File Change Detection scan will never ever show the warning.

If the above info answers your question please mark this topic as ‘resolved’.

dwinden

Hi Dwinden,

Thank you for your help. But i’m still having difficulty understanding why that message appears on my dashboard when I am not manually scanning my site. All of my scans are scheduled.

Ok wait a moment.

When you click on the View Logs or Dismiss Warning button the warning disappears. It will normally only come back when you do a manual file change detection (FCD) scan (unregardless of the scan result which I think is a bug. What’s the point of displaying a FCD warning when there are no file changes detected … it’s a false positive).

However if I understand correctly, you are not performing a manual FCD scan in your env but when the next scheduled FCD scan is completed the warning is always displayed again ? Right ?
If so is this consistently reproducable in your env ?

If it is then something must have changed in your WP env that now causes the warning to be displayed on scheduled FCD scans as well.
(Because you are sure the warning did not get displayed before …)

Maybe you added a new plugin or switched to a different active theme …
Something must have changed.

dwinden

Hi Dwinden,

To answer your question; yes, if I click View logs or dismiss warning the warning will disappear. However, it will always reappear after a scan. It might be a plug-in change, but I’m not sure which plug-in I installed during that time.

Maybe I can try re-installing iThemes to see if it will work better. Is there any other security plug-in that you would recommend?

Davina

@davina14

The irony is that I think the warning is supposed to show unregardless type of FCD scan. However due to a bug the warning would normally only show after a manual FCD scan.

So the warning now showing up in your env after a scheduled FCD scans as well actually fixes that bug …
Somehow it started working in your env the way is was designed to work in the first place.
(There is still the issue that the warning gets displayed unregardless the FCD scan result … remember the false positive I mentioned in my previous update).

You could argue that a dashboard warning is not necessary for a scheduled FCD scan because there is already an email notification send (which by the way is NOT send for a manual FCD scan by design).
But that email might never arrive (for whatever reason) or you disabled the Email File Change Notifications setting or you delete the email quickly after reading it and then forget about it. In these situations it’s still very usefull to also get the warning displayed after logging into the WP Dashboard …
The View Logs button included in the warning will also allow you to jump straight to the Logs page and check the file changes …

I got curious and could not help myself from taking a look at the relevant FCD scan code. Here it is:

if (
	function_exists( 'get_current_screen' ) && // First condition

	(					// Start second condition
	! isset( get_current_screen()->id ) ||
	false === strpos( get_current_screen()->id, 'security_page_toplevel_page_itsec_logs' )
	) &&					// End second condition

	isset( $this->settings['notify_admin'] ) && // Third condition
	true === $this->settings['notify_admin'] // Fourth condition
) {
	add_site_option( 'itsec_file_change_warning', true );
}

There are 2 important things to notice:

• 1. There is no condition that explicitly checks the FCD type (manual or scheduled).
  This confirms the warning is supposed to show unregardless FCD type.
• 2. I did a quick test and it turns out a scheduled FCD scan will normally not pass the first condition. The get_current_screen() method does not exist during a scheduled FCD scan … (bug).
  So somehow in your env the get_current_screen() method does exist during a scheduled FCD scan … and it will easily get past the other conditions.

So theoretically it is very well possible that a newly added plugin includes the WP file that defines the get_current_screen() method because that plugin needs something which is also defined in that file. As a side effect the scheduled FCD scan is able to pass the condition which it would normally not be able to pass.

You could try and temporarily deactivate, one by one, any recently installed plugin(s) and see whether the warning reverts to its previous behaviour.
The sole purpose would be to identify the plugin that affects the iTSec plugin FCD scan warning behaviour.

In the end I would not worry about the warning getting displayed.
To fix the other (false positive) bug simply replace your class-itsec-file-change.php file with this file (iTSec plugin release 5.0.1 only).
First rename the existing class-itsec-file-change.php to class-itsec-file-change.php.new and then simply copy the download file into the better-wp-security/core/modules/file-change folder while renaming the file to class-itsec-file-change.php (It’s a fake .zip file to facilitate the download).
After applying the fix you should only get a warning displayed when there are actually file changes detected.
I’ve tested the fix and it works perfectly.
Keep in mind the fix will get undone as soon as you update the iTSec plugin to the next release.

Based on my findings I don’t expect reinstalling the iTSec plugin will bring it back to working the way it did before … but you never know.
It works better now so I see no reason for un\reinstall …

I also don’t see why you should consider any other Security plugin.
I use the Sucuri Security – Auditing, Malware Scanner and Security Hardening plugin and the iTSec plugin concurrently.

Keep in mind, every (free) WP plugin has its quirks …

dwinden

Hi Dwinden,

Thanks again for clearing that up for me. I don’t think that the file changes are false positives, because wp-cache is constantly adding and deleting files. As you said this is not something to worry about, so I think I’ll leave it as it is. Thanks for taking the time to explain this for me.

Davina

@davina

I’m not saying your file changes are always false positives …

What I’m trying to explain is that due to a bug the FCD code will always display the warning unregardless FCD scan result.
This opens up the possibility of false positives.

File changes due to caching are irrelevant. You don’t want to be informed all the time of such file changes so add the cache location to the Files and Folders List setting to exclude them from the FCD scan.

You only want to be informed of relevant file changes.

Anyway I think this topic can be marked as ‘resolved’.

dwinden

That makes sense Dwinden, thanks again for explaining it to me. Have a great week.

DAvina