# WordPress security email alerts: a weekly summary and instant mail

Set up WordPress security email alerts that stay useful: a weekly summary, instant mail for high and critical events, recipients, maintenance and mute.

By M Asif Rahman, Oct 21, 2026. Updated Nov 8, 2026.

To get WordPress security email notifications that are worth reading, use two kinds of message: a weekly summary that arrives even on a quiet week, and an immediate email only for high and critical events. BetterShield sends both from **BetterShield › Settings › Email alerts**, with a switch to mute everything and a maintenance window for planned work. This guide covers what each setting does, who receives the mail, and the settings we recommend. No message ever contains an upgrade prompt.

It builds on the [WordPress activity log](/blog/wordpress-activity-log/), where every event the emails mention is recorded, and it pairs well with a [security audit](/blog/wordpress-security-audit/), whose score and findings the weekly summary reports.

An update keeps an existing site’s saved alert choices. The off-by-default behavior applies to new installs.

## Quick summary

- **BetterShield › Settings › Email alerts** controls whether security email is sent, where it goes, what each address gets, and which messages are immediate.
- The **weekly summary** goes out on Monday by default and still sends a short message on a quiet week. On a new install, since BetterShield 1.1.5, it and the instant alerts stay off until you turn them on in Quick Setup or Settings.
- **Email me about high and critical events as they happen** covers the two highest ratings; lower-rated events wait for the weekly summary.
- Recipients default to the site’s administration email, or up to five named addresses, each choosing its own instant alerts and weekly summary. **Send a Test Alert** proves the real WordPress mail path.
- **Mute all alerts** and **Planned maintenance** pause email without pausing checks, protections or the activity log.

## Why alert email needs care

A security alert is only useful if someone reads it. A site that mails every small change teaches its owner to ignore the inbox, and a site that mails nothing leaves the owner guessing. The aim is a quiet channel with two promises: a regular summary that proves the watching is happening, and a prompt message only when something rated high or critical occurs.

Email also depends on the site itself. WordPress sends it through [wp_mail()](https://developer.wordpress.org/reference/functions/wp_mail/), whose delivery depends on how your host sends mail, so BetterShield gives you a way to test the path rather than assuming it works.

## What the settings do

The screen has five main controls, and each can be changed on its own. They sit in two cards: **When alerts are sent, and to whom** holds **Mute everything**, **Planned maintenance** and **Where alerts go**, and **What gets emailed** holds the weekly summary and the instant alerts.

| Control | What it does | Default |
|---|---|---|
| **Mute all alerts** | Stops instant security email and the weekly summary. | Off |
| **Planned maintenance** | Holds routine work-related alerts for 30 minutes to 4 hours. | Not running |
| **Where alerts go** | Sends alerts to the site administration email or up to five named addresses. | Site administration email |
| **Send a weekly summary** | Emails a digest on the day you choose. | Off on a new install; Monday once enabled |
| **Email me about high and critical events as they happen** | Emails those events promptly. | Off on a new install; existing sites retain their choice |

BetterShield 1.1.5 changed one default. On a new install, instant alerts and the weekly summary stay off until you turn them on in Quick Setup or Settings. Sites that were already running keep their alerts as they were.

Account-recovery mail is separate. It still goes out while security alerts are muted, including lockout-clearing links, enabled new-network notices and replacement recovery links, so nobody is stranded by a mute.

### The weekly summary

On a new install **Send a weekly summary** starts off until you turn it on; a site already running keeps its alerts as they were. **Day** offers Sunday through Saturday, defaulting to Monday in the site’s time zone. The message covers everything since the previous summary, not a fixed seven-day slice, so a delayed week is included rather than skipped. A quiet week still sends a message saying so, which is how you know the watching has not stopped.

The email includes:

- the dates it covers;
- the current score and grade;
- open findings, and findings opened and resolved;
- activity by area;
- the highest-rated open finding to review next.

For what to do with the summary once it arrives, [WordPress security monitoring: what to look at each week](/blog/wordpress-security-monitoring/) puts it first in a short weekly routine.

**Send one now** sends the real summary immediately and starts the next reporting period from that moment, so use it to test, not as a way to peek.

### Instant alerts

**Email me about high and critical events as they happen** covers the two highest event ratings. Lower-rated events wait for the weekly summary. When several events arrive together they are collected rather than sent as one message each: the first goes promptly, and events in the next five minutes can join a follow-up.

Since BetterShield 1.1.2, an instant alert email shows times in the site’s time zone and names who made each change, so the message tells you whether the change was yours or your team’s.

To keep a noisy routine type out of your inbox, turn its switch off under **Instant alerts by type**. Its new events are still recorded in full and appear in the weekly summary when it is enabled. With the summary off, held events are not emailed. When instant alerts are enabled, critical events bypass this per-type hold; host-managed alerts use a separate policy. A type that has been critical on your site cannot be turned off. The row is described in [Hold an event type for the weekly summary](/docs/hold-an-event-type-for-the-summary/).

A host that manages sites for its customers can take over the routine alerts with `wp bettershield alerts host-managed on --user=admin`. With instant alerts enabled, only a new administrator, a role raised to administrator, the trap password or a changed code file emails at once; the rest wait for the enabled weekly summary. This mode does not enable either email switch, and the owner can switch it off in Settings. See [Host-managed alerts](/docs/host-managed-alerts/).

Email is not sent while a visitor waits for a page. The next dashboard request, WP-CLI run or hourly task handles it. A refused send is retried hourly up to three times, and then the activity log records **Alert could not be delivered**.

### Who receives alerts

Under **Where alerts go**, the named list is empty by default and alerts use the site’s administration email. Add up to five valid, distinct addresses; they do not need WordPress accounts. Once any address is named, that list is used instead of the site address.

Each named address has two choices of its own. **Instant alerts** is **High and critical** (the default), **Critical only** or **None**, and **Weekly summary** is ticked by default. A client who only wants the overview can sit on **None** with the summary ticked, and a developer on call on **Critical only** with the summary cleared. At least one address must stay on **High and critical**, so an urgent alert always reaches someone; a change that would leave none is refused. Details are in [Choose what each address gets](/docs/choose-what-each-address-gets/).

Alerts and weekly summaries also arrive in each recipient’s own language. An address that belongs to a user on the site is written in that user’s language, and any other address in the site’s language. After a test, the screen lists each address under **Each address gets alerts in:**. See [Alerts in each person’s language](/docs/alerts-in-your-language/).

### Set it up

1. Open **BetterShield › Settings › Email alerts**.
2. Under **Where alerts go**, enter an address under **Add an address** and press **Add**. Repeat for up to five. **Remove** takes one off. Beside each address, pick its **Instant alerts** level and tick or clear its **Weekly summary**.
3. Press **Send a Test Alert**. It sends one real **Alert delivery test** through the same mail path as live alerts and reports whether WordPress accepted it, whether alerts are muted, whether no recipient exists, or whether another test was sent too recently.
4. Under **What gets emailed**, check **Send a weekly summary** and choose a **Day**, then check **Email me about high and critical events as they happen**. On a new install both start off.
5. Confirm the inbox received the test.

## Planned maintenance and mute

Two controls pause email for different reasons, and they should not be confused. Our guide to [pausing security alerts for maintenance](/blog/wordpress-pause-security-alerts-maintenance/) compares them with holding a single event type.

**Planned maintenance** is for work you expect to cause routine messages, such as updating plugins. **Duration** offers **30 minutes**, **1 hour**, **2 hours** and **4 hours**, with **2 hours** preselected. **Start maintenance** holds routine administrator, plugin, theme, core and file-change alerts. The events stay in the activity log and the normal digest, and a closing summary follows when the window ends. Critical events, decoy hits, lockdowns, passkey-only arming and protection changes keep their normal immediate path, and enforcement stays on. The row shows **Active until** with a time and a count of events recorded and held. **End maintenance** finishes it early, and **Finish summary** sends a summary that is still pending.

**Mute all alerts** is for a deliberate full pause. While muted, the switches for instant email and the weekly summary appear off but return to their stored choices when you unmute. Audits, findings, protections and activity recording continue. The Overview, the dashboard widget and Activity show that alerts are muted.

These alerts go to the site’s recipients. Each person’s own account has a separate, optional email, which tells them when it signs in from a network it has not used before: see [WordPress new sign-in email](/blog/wordpress-new-sign-in-email/).

Use of the trap password still emails with instant alerts off. With BetterShield 1.1.6 and Ultra 1.0.7 or newer, use of the emergency account does too. **Mute all alerts** silences both. Check [instant security alerts](/docs/instant-security-alerts/) and the [emergency account](/docs/emergency-account/) before relying on delivery.

## What it can break, and how to undo

- **Missing something while muted.** Alerts that occur while muted are dropped, not sent later. The events remain in the activity log, but the dropped email is not replayed. Turn **Mute all alerts** off to resume delivery.
- **An address set too quiet.** An address on **Critical only** or **None** hears about a high event only in the weekly summary. When a change makes alerts quieter and **Ask for my password before removing a protection** is on under **Settings › General**, BetterShield asks for your password first.
- **A typo in a recipient.** Alerts can go to the wrong place. Correct or remove the address, and a settings-history row can restore the previous list. Removing the last named address returns delivery to the site administration email.
- **Too much email.** On a busy site, instant alerts can outrun the team. Use planned maintenance for expected work rather than turning the channel off, since turning it off makes important events wait for the weekly summary.
- **Sending a summary early.** **Send one now** resets the next summary’s starting point. Muting prevents it from being sent at all.

Every setting is reversible: switch it back, or restore the earlier value from settings history.

## Check it is working

- **Send a Test Alert** reports that WordPress accepted the message, and the effective recipient receives it. Repeat it after any change of hosting, domain mail or SMTP configuration.
- **Send one now** delivers a real weekly summary to the configured inbox.
- While muted, the alerts summary reads muted and **Send a Test Alert** states that nothing was sent until you unmute.
- During maintenance, the row shows **Active until** and the held count.
- The [activity log](/blog/wordpress-activity-log/) shows **Alert could not be delivered** if a live send keeps failing.

On a multisite network, recipients are per site.

## Recommended settings

We recommend turning on both **Send a weekly summary** and the instant high and critical email (a new install starts with both off), and spending your effort on who receives them.

- **Recipients:** a monitored shared address with at least two responsible people, rather than one person’s inbox. Test after any change of hosting or mail service.
- **Per address:** match the levels to how each person works. Keep at least one address on **High and critical**.
- **Weekly day:** a day when someone will read the summary and act on it.
- **Maintenance:** the shortest window that covers the work, started immediately before the changes, not hours earlier.
- **Mute:** only when you have another monitoring plan, and turn it off as soon as the reason ends.

| Site | What we recommend |
|---|---|
| One site, one owner | Turn on the summary and instant alerts, and add a second address you check daily. |
| Store or membership site | Keep instant alerts on, and use maintenance during plugin updates. |
| Agency or many sites | Use a shared team address on every site, with the weekly day staggered so summaries do not all land together. |

Slack, webhook and syslog delivery exist as part of BetterShield Ultra’s alert channels, in addition to email; email alerts work fully without it.

## Frequently asked questions

### How do I get a weekly WordPress security report by email?

Open **BetterShield › Settings › Email alerts**, turn **Send a weekly summary** on and pick a **Day**. Monday is the default day, and the summary arrives on quiet weeks too. On a new install it starts off until you turn it on in Quick Setup or Settings.

### Which events are emailed straight away?

High and critical events, when **Email me about high and critical events as they happen** is on. Lower-rated events wait for the weekly summary, and you can hold a routine event type for the summary too. Critical events bypass the per-type hold when instant alerts are enabled; host-managed alerts follow their separate policy.

### Can I send alerts to more than one person?

Yes. Add up to five addresses under **Where alerts go**. They do not need WordPress accounts, and once any address is named the list replaces the site administration email. Each address chooses its own instant alerts and weekly summary.

### Will I still get a lockout recovery email if I mute alerts?

Yes. Account-recovery mail, including lockout-clearing links, still goes out while security alerts are muted.

### How do I stop alert email during a plugin update?

Start **Planned maintenance** for 30 minutes to 4 hours. Routine messages are held and summarized when it ends, while critical events still go out straight away.

## Conclusion

Good alerts are few and trustworthy: a weekly summary that proves the site is being watched, and prompt mail only for high and critical events. Turn them on, send them to a shared address, test the mail path, and use maintenance rather than a mute for planned work. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/); the full reference is [Email alerts](/docs/email-alerts/), and the numbers in the weekly summary are explained in [Score and findings](/docs/score-and-findings/).