Title: Database changes detected Last modified: July 13, 2019 --- # Database changes detected * Resolved [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/) * Hey guys, * i got two e-mails today from ninjafirewall alert which are “[NinjaFirewall] Alert: Database changes detected” * “NinjaFirewall has detected that one or more administrator accounts were modified in the database: * Blog: [https://www…](https://www…);.. Date: Temmuz 13, 2019 @ 17:28: 03 (UTC +0300) * Total administrators : 1 * Admin ID: -user_login: -user_nicename: -user_email: -user_registered: -display_name: * If you cannot see any modifications in the above fields, it is possible that the administrator password was changed.” * but as you see there was no changing * and the firewall logs: * 13/Jul/19 14:28:05 #5851438 INFO – 0.0.0.0 N/A – – Database changes detected –[ administrator account] – [http://www.website.](http://www.website.). 13/Jul/ 19 14:29:33 #3618773 INFO – 0.0.0.0 N/A – – Database changes detected – [administrator account] – [http://www.website.](http://www.website.). 13/Jul/19 14:30:47 #8933548 INFO – 0.0.0.0 N/A – – Database changes detected – [administrator account] – [http://www.website.](http://www.website.). * and im sure there is nobody to change the password so why i got this alert? Any help? Viewing 14 replies - 1 through 14 (of 14 total) * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11729776) * NinjaFirewall takes all admin accounts data, makes a hash and saves it. Then, later on, it does it again and compares both hashes. If they don’t match, it warns you. For whatever reason, this could be a false alert. This can happen but it has to be very seldom, not everyday * Thread Starter [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11730047) * I got 16-17 e-mails until now and i really dont understand whats wrong with it. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11730361) * 1. Copy/paste the following code to a file, name it `whatever.php`, upload it into the WordPress root folder, go to `http://your-blog/whatever.php`, copy and save the output. Delete the script. 2. Wait to receive another alert from NinjaFirewall and then upload/run again the script and compare the results. * ``` 'administrator', 'fields' => array( 'ID', 'user_login', 'user_pass', 'user_nicename', 'user_email', 'user_registered', 'display_name' ) ) ); print_r( $admin ); ``` * **Don’t forget to remove the script from your site**. * Thread Starter [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11730644) * I have tested it and the informations are the same so nothing changed. * `Array ( [0] => stdClass Object ( [ID] => 1 [user_login] => same [user_pass] => same [user_nicename] => same [user_email] => same [user_registered] => same[ display_name] => same ) * ) * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11733471) * Is it a multisite? * [burlingtonpress](https://wordpress.org/support/users/burlingtonpress/) * (@burlingtonpress) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11738080) * Just came here for the same reason. I actually used to get these multiple times per day back a couple of years ago, but they went away after a previous update. * However, they seem to have returned. 2 today so far. The first one looked like this: * Total administrators : 1 * Admin ID: -user_login: -user_nicename: -user_email: -user_registered: -display_name: * But the second one, just received, had all of my info after the field names. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11741084) * Can you give me the list of plugins that are enabled on your blog? Any caching plugin? * Thread Starter [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11741757) * Multisite? I just have wpml language plugin so there are 3 language options on the web site. I still have these emails per day and got a lot of emails.. * I have wp rocket cache plugin and if you r asking me the plugin list, i can share it with you. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11745366) * I think it is related to your caching plugin. NinjaFirewall simply calls the WordPress [get_users](https://developer.wordpress.org/reference/functions/get_users/) function but it looks like sometimes, when a caching plugin is installed, this function returns an empty value. It must be related to database or object caching I suppose. I will check if I can change the code, maybe to use [WP_User_Query](https://developer.wordpress.org/reference/classes/wp_user_query/) instead. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11748719) * I have made a small change to the function that is used to monitor the DB: [https://plugins.trac.wordpress.org/changeset/2125836/ninjafirewall/trunk/lib/utils.php?old=2118697&old_path=ninjafirewall%2Ftrunk%2Flib%2Futils.php](https://plugins.trac.wordpress.org/changeset/2125836/ninjafirewall/trunk/lib/utils.php?old=2118697&old_path=ninjafirewall%2Ftrunk%2Flib%2Futils.php) * For those who want to try it: 1. Make sure you are running NinjaFirewall WP 4.0.1. 2. Download this script: [https://plugins.trac.wordpress.org/export/HEAD/ninjafirewall/trunk/lib/utils.php](https://plugins.trac.wordpress.org/export/HEAD/ninjafirewall/trunk/lib/utils.php) 3. Over FTP, upload it into your `wp-content/plugins/ninjafirewall/lib` folder and override the current `utils.php` script. * Thread Starter [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11755718) * Thanks for the support but it is still same. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11759950) * Can you check the configuration of your caching plugin: did you enable any option related to database or object caching? * Thread Starter [M-POWER](https://wordpress.org/support/users/phyton/) * (@phyton) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11760047) * I haven’t done any changes except updating plugins, not changed / enabled or disabled any options. If you wanna check this, i can give you an admin account. * Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/) * (@nintechnet) * [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11766532) * I’m not familiar at all with the wp rocket cache plugin, but if you go to its settings page, do you see any options related to database or object caching? Which one, if any, is enabled? Viewing 14 replies - 1 through 14 (of 14 total) The topic ‘Database changes detected’ is closed to new replies. * ![](https://ps.w.org/ninjafirewall/assets/icon-256x256.png?rev=976137) * [NinjaFirewall (WP Edition) - Advanced Security Plugin and Firewall](https://wordpress.org/plugins/ninjafirewall/) * [Frequently Asked Questions](https://wordpress.org/plugins/ninjafirewall/#faq) * [Support Threads](https://wordpress.org/support/plugin/ninjafirewall/) * [Active Topics](https://wordpress.org/support/plugin/ninjafirewall/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/ninjafirewall/unresolved/) * [Reviews](https://wordpress.org/support/plugin/ninjafirewall/reviews/) ## Tags * [database](https://wordpress.org/support/topic-tag/database/) * 14 replies * 3 participants * Last reply from: [nintechnet](https://wordpress.org/support/users/nintechnet/) * Last activity: [6 years, 10 months ago](https://wordpress.org/support/topic/database-changes-detected/#post-11766532) * Status: resolved