WordPress security email alerts: a weekly summary and instant mail

To get WordPress security email notifications that are worth reading, use two kinds of message: a weekly summary that arrives even on a quiet week, and an immediate email only for high and critical events. BetterShield sends both from BetterShield › Settings › Email alerts, with a switch to mute everything and a maintenance window for planned work. This guide covers what each setting does, who receives the mail, and the settings we recommend. No message ever contains an upgrade prompt.

It builds on the WordPress activity log, where every event the emails mention is recorded, and it pairs well with a security audit, whose score and findings the weekly summary reports.

An update keeps an existing site’s saved alert choices. The off-by-default behavior applies to new installs.

Quick summary

• BetterShield › Settings › Email alerts controls whether security email is sent, where it goes, what each address gets, and which messages are immediate.
• The weekly summary goes out on Monday by default and still sends a short message on a quiet week. On a new install, since BetterShield 1.1.5, it and the instant alerts stay off until you turn them on in Quick Setup or Settings.
• Email me about high and critical events as they happen covers the two highest ratings; lower-rated events wait for the weekly summary.
• Recipients default to the site’s administration email, or up to five named addresses, each choosing its own instant alerts and weekly summary. Send a Test Alert proves the real WordPress mail path.
• Mute all alerts and Planned maintenance pause email without pausing checks, protections or the activity log.

Why alert email needs care

A security alert is only useful if someone reads it. A site that mails every small change teaches its owner to ignore the inbox, and a site that mails nothing leaves the owner guessing. The aim is a quiet channel with two promises: a regular summary that proves the watching is happening, and a prompt message only when something rated high or critical occurs.

Email also depends on the site itself. WordPress sends it through wp_mail(), whose delivery depends on how your host sends mail, so BetterShield gives you a way to test the path rather than assuming it works.

What the settings do

The screen has five main controls, and each can be changed on its own. They sit in two cards: When alerts are sent, and to whom holds Mute everything, Planned maintenance and Where alerts go, and What gets emailed holds the weekly summary and the instant alerts.

BetterShield 1.1.5 changed one default. On a new install, instant alerts and the weekly summary stay off until you turn them on in Quick Setup or Settings. Sites that were already running keep their alerts as they were.

Account-recovery mail is separate. It still goes out while security alerts are muted, including lockout-clearing links, enabled new-network notices and replacement recovery links, so nobody is stranded by a mute.

The weekly summary

On a new install Send a weekly summary starts off until you turn it on; a site already running keeps its alerts as they were. Day offers Sunday through Saturday, defaulting to Monday in the site’s time zone. The message covers everything since the previous summary, not a fixed seven-day slice, so a delayed week is included rather than skipped. A quiet week still sends a message saying so, which is how you know the watching has not stopped.

The email includes:

• the dates it covers;
• the current score and grade;
• open findings, and findings opened and resolved;
• activity by area;
• the highest-rated open finding to review next.

For what to do with the summary once it arrives, WordPress security monitoring: what to look at each week puts it first in a short weekly routine.

Send one now sends the real summary immediately and starts the next reporting period from that moment, so use it to test, not as a way to peek.

Instant alerts

Email me about high and critical events as they happen covers the two highest event ratings. Lower-rated events wait for the weekly summary. When several events arrive together they are collected rather than sent as one message each: the first goes promptly, and events in the next five minutes can join a follow-up.

Since BetterShield 1.1.2, an instant alert email shows times in the site’s time zone and names who made each change, so the message tells you whether the change was yours or your team’s.

To keep a noisy routine type out of your inbox, turn its switch off under Instant alerts by type. Its new events are still recorded in full and appear in the weekly summary when it is enabled. With the summary off, held events are not emailed. When instant alerts are enabled, critical events bypass this per-type hold; host-managed alerts use a separate policy. A type that has been critical on your site cannot be turned off. The row is described in Hold an event type for the weekly summary.

A host that manages sites for its customers can take over the routine alerts with wp bettershield alerts host-managed on --user=admin. With instant alerts enabled, only a new administrator, a role raised to administrator, the trap password or a changed code file emails at once; the rest wait for the enabled weekly summary. This mode does not enable either email switch, and the owner can switch it off in Settings. See Host-managed alerts.

Email is not sent while a visitor waits for a page. The next dashboard request, WP-CLI run or hourly task handles it. A refused send is retried hourly up to three times, and then the activity log records Alert could not be delivered.

Who receives alerts

Under Where alerts go, the named list is empty by default and alerts use the site’s administration email. Add up to five valid, distinct addresses; they do not need WordPress accounts. Once any address is named, that list is used instead of the site address.

Each named address has two choices of its own. Instant alerts is High and critical (the default), Critical only or None, and Weekly summary is ticked by default. A client who only wants the overview can sit on None with the summary ticked, and a developer on call on Critical only with the summary cleared. At least one address must stay on High and critical, so an urgent alert always reaches someone; a change that would leave none is refused. Details are in Choose what each address gets.

Alerts and weekly summaries also arrive in each recipient’s own language. An address that belongs to a user on the site is written in that user’s language, and any other address in the site’s language. After a test, the screen lists each address under Each address gets alerts in:. See Alerts in each person’s language.

Set it up

1. Open BetterShield › Settings › Email alerts.
2. Under Where alerts go, enter an address under Add an address and press Add. Repeat for up to five. Remove takes one off. Beside each address, pick its Instant alerts level and tick or clear its Weekly summary.
3. Press Send a Test Alert. It sends one real Alert delivery test through the same mail path as live alerts and reports whether WordPress accepted it, whether alerts are muted, whether no recipient exists, or whether another test was sent too recently.
4. Under What gets emailed, check Send a weekly summary and choose a Day, then check Email me about high and critical events as they happen. On a new install both start off.
5. Confirm the inbox received the test.

Planned maintenance and mute

Two controls pause email for different reasons, and they should not be confused. Our guide to pausing security alerts for maintenance compares them with holding a single event type.

Planned maintenance is for work you expect to cause routine messages, such as updating plugins. Duration offers 30 minutes, 1 hour, 2 hours and 4 hours, with 2 hours preselected. Start maintenance holds routine administrator, plugin, theme, core and file-change alerts. The events stay in the activity log and the normal digest, and a closing summary follows when the window ends. Critical events, decoy hits, lockdowns, passkey-only arming and protection changes keep their normal immediate path, and enforcement stays on. The row shows Active until with a time and a count of events recorded and held. End maintenance finishes it early, and Finish summary sends a summary that is still pending.

Mute all alerts is for a deliberate full pause. While muted, the switches for instant email and the weekly summary appear off but return to their stored choices when you unmute. Audits, findings, protections and activity recording continue. The Overview, the dashboard widget and Activity show that alerts are muted.

These alerts go to the site’s recipients. Each person’s own account has a separate, optional email, which tells them when it signs in from a network it has not used before: see WordPress new sign-in email.

Use of the trap password still emails with instant alerts off. With BetterShield 1.1.6 and Ultra 1.0.7 or newer, use of the emergency account does too. Mute all alerts silences both. Check instant security alerts and the emergency account before relying on delivery.

What it can break, and how to undo

• Missing something while muted. Alerts that occur while muted are dropped, not sent later. The events remain in the activity log, but the dropped email is not replayed. Turn Mute all alerts off to resume delivery.
• An address set too quiet. An address on Critical only or None hears about a high event only in the weekly summary. When a change makes alerts quieter and Ask for my password before removing a protection is on under Settings › General, BetterShield asks for your password first.
• A typo in a recipient. Alerts can go to the wrong place. Correct or remove the address, and a settings-history row can restore the previous list. Removing the last named address returns delivery to the site administration email.
• Too much email. On a busy site, instant alerts can outrun the team. Use planned maintenance for expected work rather than turning the channel off, since turning it off makes important events wait for the weekly summary.
• Sending a summary early. Send one now resets the next summary’s starting point. Muting prevents it from being sent at all.

Every setting is reversible: switch it back, or restore the earlier value from settings history.

Check it is working

• Send a Test Alert reports that WordPress accepted the message, and the effective recipient receives it. Repeat it after any change of hosting, domain mail or SMTP configuration.
• Send one now delivers a real weekly summary to the configured inbox.
• While muted, the alerts summary reads muted and Send a Test Alert states that nothing was sent until you unmute.
• During maintenance, the row shows Active until and the held count.
• The activity log shows Alert could not be delivered if a live send keeps failing.

On a multisite network, recipients are per site.

Recommended settings

We recommend turning on both Send a weekly summary and the instant high and critical email (a new install starts with both off), and spending your effort on who receives them.

• Recipients: a monitored shared address with at least two responsible people, rather than one person’s inbox. Test after any change of hosting or mail service.
• Per address: match the levels to how each person works. Keep at least one address on High and critical.
• Weekly day: a day when someone will read the summary and act on it.
• Maintenance: the shortest window that covers the work, started immediately before the changes, not hours earlier.
• Mute: only when you have another monitoring plan, and turn it off as soon as the reason ends.

Slack, webhook and syslog delivery exist as part of BetterShield Ultra’s alert channels, in addition to email; email alerts work fully without it.

Frequently asked questions

Conclusion

Good alerts are few and trustworthy: a weekly summary that proves the site is being watched, and prompt mail only for high and critical events. Turn them on, send them to a shared address, test the mail path, and use maintenance rather than a mute for planned work. BetterShield is free on WordPress.org; the full reference is Email alerts, and the numbers in the weekly summary are explained in Score and findings.