Notifications about plugin updates despite deactivation

Create a “check-updates.php” file with the following code, upload it into your WordPress root folder and access it with your browser: https://your-site.tld/check-updates.php.
That will show you whether the option is really disabled in the DB.

<?php
header('Content-type: text/plain');
require 'wp-config.php';
$nfw_options = get_option('nfw_options');
if ( empty( $nfw_options['secupdates'] ) ) {
echo "Security updates notification is disabled.";
} else {
echo "Security updates notification is enabled.";
}

It is disabled.
Do you have a site in a parent folder where NF is installed ?

Do you have another instance of the site like a dev or staging site on that server or another one, that could be the one sending the notification?

That’s very odd.

Did you check in the NinjaFirewall > Dashboard page if there was any warning or error?

Can you check the WordPress scheduled tasks:
1. Install and activate https://ww.wp.xz.cn/plugins/wp-crontrol/
2. Go to “Tools > Cron Events”.
3. Make sure there’s only one instance of “nfwgccron”. It should be running hourly.

You can try to go to the “Plugins” page, deactivate and reactivate NinjaFirewall. When you do that, it will check and fix any potential issue.

Let’s wait and see.

Nothing else sends those notifications.
Try to edit the code:

1. Open wp-content/plugins/ninjafirewal/lib/event_updates.php
2. Line 25, add this code : return;

It will look like this:

26   function nfw_check_security_updates() {
27      return;
28      $nfw_checked = nfw_get_option( 'nfw_checked' );

If you still received notifications, that would mean another instance of NinjaFirewall is running.