WordPress security alerts worth reading

Why WordPress security alerts need to be selective

Protection works quietly, so alerts are how you hear about the moments that need a person, such as an unexpected new administrator or a malware finding, while there is still time to act.

If every event pings your phone, you soon stop reading. The goal is a small number of emails you trust: urgent ones straight away, everything else rolled into a summary.

The WordPress security alerts Stack Guard can send

The Alert Matrix on the Notifications tab lists every alert in five groups. Each alert has its own switch, a severity and a delivery choice: Immediate, Hourly summary or Digest only. Critical alerts, such as lockouts and malware found, are always sent straight away.

• Access: administrator sign-ins, new devices, password changes, new administrators and role changes.
• Threats: lockouts, repeated failed sign-ins, new bans, 404 floods and firewall blocks.
• Integrity: malware, file changes and finished scans.
• Maintenance: updates, security key reminders and licence reminders.
• Reports: the daily and weekly digests.
• Free includes the lockout alert. Pro includes the full catalogue.

Digests, quiet hours and rate limits

On Pro, the Daily Security Digest arrives every morning at 08:00 and the Weekly Security Digest on Monday at 08:00, site time. They show failed sign-ins, lockouts, bans and blocked requests with the change against the period before, the addresses with the most failed sign-ins, new administrators and role changes, changed files, new malware findings, waiting updates, the age of your last good backup and your security score. A section with nothing in it is left out, and on a quiet day you can get a one-line All Quiet email so silence never looks broken. You can also hide addresses so a digest gives counts only.

Quiet hours hold non-critical alerts overnight for the digest. A rate limit caps how many alerts arrive per hour, day or week, and combines the extras into the hourly summary or queues them. Critical alerts ignore both, so a lockout or malware alert always gets through.

Set up alerts that get read

Open the Notifications tab, switch on Email Alerts under Delivery and add your recipients. Without any, alerts go to the site admin email address. Click Send Test Email and check it arrives, including the spam folder. Email from WordPress sites often lands in spam, and an email delivery plugin with a proper sending service helps.

On Pro, the Template Studio lets you edit the subject and wording of every alert, add details with placeholders, set the header colour, and preview in light or dark, at desktop or phone width, or as plain text. Every email uses the same layout, with a plain-text version and a dark version.

Slack, Microsoft Teams, webhook and text message alerts are coming soon. On Agency, your plugin name, company name, website and logo replace Stack Guard in every email.