Email alerts

This feature emails you on two specific events. The first is a lockout: when the login attempt limiter blocks an IP address, you get a message with the address, how many attempts it made, the username it tried and how long the lockout lasts. The second is an administrator login: whenever an administrator account signs in successfully, you get the username, the IP address and the time.

Alerts go to your WordPress administrator email address by default, and you can point them somewhere else – a shared mailbox, or an address that reaches you outside working hours.

It is deliberately limited to two events. Security tooling that emails constantly gets filtered, and a rule that hides your alerts is worse than no alerts.

Lockout alerts tell you that automated attacks are being blocked, which is reassuring and occasionally useful for spotting a sustained campaign against one account.

The administrator login alert is the one worth paying attention to. If you receive a message saying an admin signed in from an address you do not recognise, at a time you were not working, you have found a compromise within minutes rather than whenever someone happens to notice defaced content. Compromised sites often go unnoticed for weeks, and that gap is where most of the damage happens.

Alerts are sent through wp_mail, the standard WordPress mail function. On a default install that hands off to the server mail transport, which many hosts either do not configure or actively rate limit. If your site cannot send reliable email, these alerts will be unreliable too.

If alerts do not arrive, install an SMTP plugin and route wp_mail through an authenticated mail service. This is worth doing regardless, since password reset emails depend on the same path.