Torsten Landsiedel

No, we just modified the name of the sender from “WordPress” to the clients company name via filter.

Today it happened again. I got one email for each of the 60 sites this user is the admin for. But there weren’t any modifications in the users table (maybe usermeta?). This time I asked the user immediately if she changed the password as I saw no other modification, but she said, she just logged in and edited some pages.

The Ninjascanner has nothing to report in the DB snapshot area.

Any idea what can cause this?

Yes, mostly the same time. The first batch of 10 is all 13:11, then 20 at 13:12 and the next hour every minute a batch of at least 2 to 10.

This is a subfolder install, but the sites are using subdomain URLs, maybe this is confusing your plugin?

Hi Danny,

will email you! Thanks for the offer 👍

One thing I wasn’t expecting is that the collation of the tables from Koko is ascii_general_ci instead of utf8mb4 as all the others tables:

View post on imgur.com

You are right, the Posts table in the backend (not database) is empty. I saw referrers and the charts and therefore thought the data is there, but all posts are missing.

After doing the migrations again, I have even more DB failures:

SELECT COUNT(DISTINCT(post_id))
FROM wp_wm_koko_analytics_post_stats
WHERE post_id IS NOT NULL
AND path_id IS NULL

Unknown column 'post_id' in 'SELECT'
	

    KokoAnalytics\Admin\Controller->action_admin_notices()

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_post_stats CHANGE COLUMN id post_id INT UNSIGNED

Duplicate entry '2025-09-23-12061' for key 'PRIMARY'
	

    include(wp-content/plugins/koko-analytics/migrations/007-prepare-post-stats-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_post_stats
ADD COLUMN path_id INT UNSIGNED

Duplicate column name 'path_id'
	

    include(wp-content/plugins/koko-analytics/migrations/007-prepare-post-stats-table.php)

	Plugin: koko-analytics
SELECT COUNT(DISTINCT(post_id))
FROM wp_wm_koko_analytics_post_stats
WHERE post_id IS NOT NULL
AND path_id IS NULL

Unknown column 'post_id' in 'SELECT'
	

    include(wp-content/plugins/koko-analytics/migrations/007-prepare-post-stats-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_post_stats
DROP PRIMARY KEY,
ADD PRIMARY KEY(date, path_id)

Duplicate entry '2022-05-01-0' for key 'PRIMARY'
	

    include(wp-content/plugins/koko-analytics/migrations/007-prepare-post-stats-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_post_stats MODIFY COLUMN post_id INT UNSIGNED NOT NULL DEFAULT 0

Unknown column 'post_id' in 'wp_wm_koko_analytics_post_stats'
	

    include(wp-content/plugins/koko-analytics/migrations/010-fix-post-id-column-type.php)

	Plugin: koko-analytics
INSERT INTO wp_wm_koko_analytics_post_stats (date, path_id, post_id, visitors, pageviews)
SELECT ps.date, c.canonical_id, MAX(ps.post_id), SUM(ps.visitors), SUM(ps.pageviews)
FROM wp_wm_koko_analytics_post_stats ps
JOIN wp_wm_koko_analytics_paths p
ON ps.path_id = p.id
JOIN (
SELECT LEFT(path, 255) AS prefix, MIN(id) AS canonical_id
FROM wp_wm_koko_analytics_paths
GROUP BY prefix ) c
ON LEFT(p.path, 255) = c.prefix
WHERE ps.path_id != c.canonical_id
GROUP BY ps.date, c.canonical_id
ON DUPLICATE KEY
UPDATE visitors = wp_wm_koko_analytics_post_stats.visitors + VALUES(visitors), pageviews = wp_wm_koko_analytics_post_stats.pageviews + VALUES(pageviews)

Unknown column 'ps.post_id' in 'SELECT'
	

    include(wp-content/plugins/koko-analytics/migrations/013-merge-duplicate-paths.php)

	Plugin: koko-analytics
RENAME TABLE wp_wm_koko_analytics_referrer_urls TO wp_wm_koko_analytics_referrer_labels

Table 'd0393d51.wp_wm_koko_analytics_referrer_urls' doesn't exist
	

    include(wp-content/plugins/koko-analytics/migrations/017-rename-referrers-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_referrer_labels CHANGE url value VARCHAR(255) NOT NULL

Unknown column 'url' in 'wp_wm_koko_analytics_referrer_labels'
	

    include(wp-content/plugins/koko-analytics/migrations/017-rename-referrers-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_referrer_stats CHANGE visitors unique_hits INT UNSIGNED NOT NULL DEFAULT 0

Unknown column 'visitors' in 'wp_wm_koko_analytics_referrer_stats'
	

    include(wp-content/plugins/koko-analytics/migrations/017-rename-referrers-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_referrer_stats CHANGE pageviews hits INT UNSIGNED NOT NULL DEFAULT 0

Unknown column 'pageviews' in 'wp_wm_koko_analytics_referrer_stats'
	

    include(wp-content/plugins/koko-analytics/migrations/017-rename-referrers-table.php)

	Plugin: koko-analytics
ALTER TABLE wp_wm_koko_analytics_referrer_labels
DROP INDEX url,
ADD UNIQUE INDEX (value)

Can't DROP INDEX url; check that it exists
	

    include(wp-content/plugins/koko-analytics/migrations/018-recreate-referrers-url-index.php)

	Plugin: koko-analytics
SELECT p.path, s.post_id, IFNULL(NULLIF(wp.post_title, ''), p.path) AS label, SUM(visitors) AS visitors, SUM(pageviews) AS pageviews
FROM wp_wm_koko_analytics_post_stats s
JOIN wp_wm_koko_analytics_paths p
ON p.id = s.path_id
LEFT JOIN wp_wm_posts wp
ON wp.ID = s.post_id
WHERE s.date BETWEEN '2026-03-20'
AND '2026-04-17'
GROUP BY p.path, s.post_id
ORDER BY pageviews DESC, visitors DESC, s.path_id ASC
LIMIT 0, 20

Unknown column 's.post_id' in 'SELECT'

Hi @bruandet

thanks for the fast reply! The mail looks like this:

NinjaFirewall has detected that one or more administrator accounts were modified in the 
database:

Blog: https://abc.example.de/
Date: April 15, 2026 @ 14:45:08 CEST
Total administrators:  1

Admin ID: 8
-user_login: (removed)
-user_nicename: (removed)
-user_email: (removed)
-user_registered: 2025-11-20 14:10:04
-display_name: (removed)



If you cannot see any modifications in the above fields, it is possible that the administrator password was changed.

This notification can be turned off from NinjaFirewall "Event Notifications" page.

NinjaFirewall (WP Edition) - https://nintechnet.com/

If you don't have access to that site any longer, you can remove your email by clicking the following link (valid for 12 hours): (removed)

The “Blog:” line mentions the subdomain, but the From address is always the main site, so I would assume it is the main site sending it 300+ times.

Any ideas what can cause this? I’m fine with PHP and can debug if you need more details.

Our setup is a little bit uncommon and complex …

All the best
Torsten