Support

This feature checks the file size (in bytes), file modification time and its MD5 and SHA1 checksums. If the contents are identical as you say, the file size and checksums would be identical. This leaves the file modification time.

Do note that a file three different timestamps on UNIX-compatible operating systems: creation, modification and access. The creation time is when the file was first created on the filesystem. The modification time is when the file was last written to. The access time (which is not always available) is when the file was last read.

If your template's index.php file is written to without any changes made to it its file modification time would change, triggering the email. This could happen for many reasons. Legitimate reasons would be updating the template or restoring a backup. In both cases the file is overwritten with the one from the update/backup package but its contents might indeed remain unmodified. Still, it got written to therefore it needs to be reported as modified. I'll get back to why this happens. Illegitimate reasons could be a badly written template or plugin overwriting the index.php file when no changes need to be made (that'd be a potentially dangerous mistake) or a hacked site making temporary changes to the template's index.php file to allow an attacker perform something nefarious and then restore the original contents to avoid detection. This is why we are triggering the email on file modification change even if the contents are identical. We can't be sure that the file wasn't temporarily modified and then restored back to its original contents.

What you need to do is check whether your file appears modified simply because you updated the template or restored a backup. If this is the case you do not need to worry about it.