Knowledge Base

What do these ChangeAlert Notification emails mean?

Updated on August 21, 2026

Overview

By the end of this article, you will be able to interpret a ChangeAlert notification email and decide whether the reported change needs action. The article explains what a ChangeAlert notification is, then covers three ways to investigate a change: reviewing the Backup Details page in your dashboard, downloading a ZIP archive of the backup to compare file contents, and asking your web developer. It also explains what CodeGuard support can tell you, what to do when a change is unexpected, and how to stop alerts for directories you do not need to monitor.

What is a ChangeAlert notification?

A ChangeAlert notification is an email CodeGuard sends when a backup shows that files on your website have been added, modified, or deleted since the previous backup. The email reports that a change occurred; it does not state what caused the change. Changes are often routine, such as a plugin or theme update, but the notification exists so that you can confirm whether each change was expected.

Before you begin

You need the following to investigate a ChangeAlert notification:

Your CodeGuard sign-in credentials
The ChangeAlert notification email, which shows the date of the backup that reported the change
A text editor, if you plan to compare the contents of changed files

Method 1 — Review the Backup Details page in your dashboard

The Backup Details page lists every file that was added, modified, or deleted in a specific backup, so it is the fastest way to see what a ChangeAlert notification refers to.

Sign in to the CodeGuard dashboard.
Click the name of the website you want to inspect.
Click the Details button for the date shown in the ChangeAlert notification email. The button is below the graph.

Figure 1: Backup Details timeline in the CodeGuard dashboard showing available backups and the selected backup date. Use the Details button for the backup referenced in the ChangeAlert notification to review files that were added, modified, or deleted during that backup.
Review the list of added, modified, and deleted files, and check whether you recognize the changes.
Read the full path of each file, because the path often identifies the cause. Files under a path such as plugins point to a WordPress plugin change, which happens when you update a plugin and also when a plugin or theme updates automatically.

Figure 2: Backup Details page in the CodeGuard dashboard displaying files identified as changed during a backup. Review the file names and paths listed here to determine whether the reported changes correspond to expected website updates, such as plugin or theme modifications.

Method 2 — Download a ZIP archive of the backup and compare files

Downloading a ZIP archive lets you open the changed files and see exactly what content was modified, which the Backup Details page does not show.

Download the archive for the backup named in the ChangeAlert notification, and download the previous backup as well.
Open the changed files from both archives in a text editor and compare them to see what was added, removed, or edited.

Figure 3: CodeGuard Restore Options page showing the Download Zip option. Use this option to generate and download a ZIP archive of a selected backup so you can review and compare changed files reported in a ChangeAlert notification.

Method 3 — Ask your web developer

A web developer who works on your site can often identify a change faster than the file list alone allows, because they know what work has been done recently.

Forward the ChangeAlert notification email to your developer and ask them to confirm whether the change was expected.
If you built the site yourself and the alerts remain unclear, consider engaging a developer to review the site.

What CodeGuard support can and cannot tell you

CodeGuard support can help with the backup service itself, such as accessing backups, downloading archives, and filtering notifications. CodeGuard support does not interpret what a specific ChangeAlert notification means for your website, because every website is built and maintained differently. The three methods above are the ways to establish the cause yourself.

What to do if a change was not expected

If you do not recognise a change and are concerned that your website has been compromised, restore your site to a backup from a date before the change appeared. Use the restore function in the CodeGuard dashboard and select a backup taken before the ChangeAlert notification you are investigating.

How to stop alerts for directories you do not need to monitor

If ChangeAlert notifications report the same directories changing every day and those directories do not matter to you, CodeGuard can exclude them. Submit a support request naming the directories you want filtered, and those directories will no longer appear in your notification emails.

Frequently asked questions

Why did I receive a ChangeAlert notification when I did not change anything?

Websites change without direct action, most commonly when plugins or themes update automatically. Open the Backup Details page for the date in the email and read the file paths to see which component changed.

Does a ChangeAlert notification mean my site was hacked?

Not by itself. A ChangeAlert notification reports that files changed, not why. Review the changed files first, and if the change is unexpected and unexplained, restore the site to a backup from before the change.