Support

You don't have 127 pages of unsafe files, you have 127 pages of files. Of all of your files. Those marked as unsafe are 4-6 pages on a typical site. Our documentation tells you exactly what you need to do about them.

THe first time you run a scan, all files are reported as new, because the scanner had never seen them again. As you will see, most of the files have a threat score of 0. If you think about it, it makes sense. If it doesn't make sense, please read the documentation.

The data doesn't take much database space. The first scan occupies about 1Mb. Subsequent scans occupy MUCH less space (usually 10-30Kb per scan). The reason is that the first scan draws information about all of the files on the site, subsequent scans only log the differences (modified files).

Hi Paul,

Let me correct you: All files are NOT marked as safe. This is completely different than saying "all files are marked as unsafe". This is expected. I will explain below what the safe mark does. You only needed to check the files with a non-zero threat score (suspicious files) which are the first 4-6 pages on a typical site.

What I did now is checking all files with high scores for suspicious lines and after that marked ALL files as safe so the next scan will only check for differences and/or new files.

You didn't have to do that for all files. It would suffice to mark only the files with a non-zero threat score as safe.

Let me explain this.

Assume that we have a file which is perfectly legitimate, but has a non-zero threat score. This is a false positive. We don't want every subsequent scan to report the file as suspicious. Therefore, we have to mark it as Safe. This has a very simple effect. Unless the file's contents, length or timestamp change, subsequent scans will not report the file as suspicious (we know that its current contents are legitimate, but throw false alarms). Marking a non-suspicious (threat score = 0) file as safe doesn't make any difference at all.

You're welcome and thank you for your kind words!