WordPress security monitoring: what to look at each week

Q: What if the Overview shows nothing new?

That is a normal result. The What changed since your last visit card appears when relevant changes were recorded after your last visit, and Unusual activity this week appears only when something is well outside the recent pattern. If neither shows, the summary email is still worth a glance for the score and open findings.

Q: Can someone else receive the summary?

Yes. Each named address has its own Weekly summary box, ticked by default, and only ticked addresses receive it. See Choose who receives alerts.

WordPress security monitoring is a short, regular look at what changed on your site, and BetterShield gives you four places to do it from: the weekly summary email, the Overview, an audit comparison, and the activity record behind them. This guide turns them into a routine you can run once a week, in a set order, using only what the plugin records and reports. BetterShield does not watch the site around the clock and promise to catch everything. It keeps a record, and the routine is how you read it.

The audit itself is explained in WordPress security audit: what 71 checks look at, and what they miss, and the email settings in WordPress security email alerts: a weekly summary and instant mail. This post adds the order to read them in and what to look for in each.

An update keeps an existing site’s saved alert choices. The off-by-default behavior applies to new installs.

Quick summary

Monitoring here means reading what BetterShield has already recorded: a daily audit, a 30-day activity history and a weekly summary email.
On new installs, the weekly summary starts off until you enable it and arrives on Monday in the site’s time zone, even after a quiet week.
What changed since your last visit on the Overview shows recorded changes after you last opened it, with who made each one.
What changed, check by check compares today’s audit with the end of an earlier day you choose.
BetterShield records and reports. It has no firewall or malware scanner, and an empty week is not proof that nothing happened.

What monitoring means for a WordPress site

A site changes all the time. Someone updates a plugin, an editor gets a new role, a scheduled task runs late, a setting is saved. Most of it is routine. The aim of monitoring is to notice the change that was not routine, soon enough to ask about it.

BetterShield does not try to do that by guessing. It runs its audit once a day and keeps the results, records account, extension and settings changes in the activity log, and emails a summary. Each of those is a record, and a record only helps when someone reads it. That is the weekly routine: the same few places, in the same order, so a change that is out of place stands out.

Two limits are worth stating plainly. The audit checks the site’s configuration, and the activity log covers sign-ins, accounts, extensions and selected settings. Neither is a malware scan, and neither records edits to posts or pages. If you need those, you need another tool next to this one. The WordPress documentation for the Site Health screen describes the checks WordPress itself runs, and BetterShield’s findings can appear there too.

The routine, in order

Here is the whole week in one table. Each row is a place to look and the question to ask there.

Step	Where	What you are looking for
1	The weekly summary email	The score and grade, open findings, and anything new since last week
2	BetterShield › Overview	What changed since your last visit, and who made each change
3	What changed, check by check	Checks that opened, changed severity or passed since the day you pick
4	Unusual activity this week	Failed sign-ins or task timing far outside the site’s recent pattern
5	BetterShield › Activity › Site activity	The records behind anything that did not make sense
6	Tools › Site Health › Status	Open findings, next to WordPress’s own tests

You will not need every row every week. On most weeks steps 1 and 2 are enough, and the rest are there for the weeks they matter.

Step 1: read the weekly summary

On new installs, the weekly summary starts off until you enable it. You choose the Day under BetterShield › Settings › Email Alerts › What gets emailed, and it is Monday unless you change it. It covers everything since the previous summary rather than a fixed seven days, so a delayed week is included and not skipped. A quiet week still sends a message that says so.

The email names the dates it covers, the current score and grade, open findings, findings opened and resolved, activity by area, and the highest-rated open finding to look at next. That last line is a good place to start. The first summary waits until BetterShield has been active for a full day, so a new install does not send an empty message minutes later. The setup is in Send a weekly security summary.

Step 2: open the Overview

Open BetterShield › Overview. When the activity log has relevant changes after your previous visit, the What changed since your last visit card lists them: what changed, who or what made the change, and when. It is a shortcut into the activity history and not a second log, and it shows changes to sign-in protection, the password policy, alerts and decoy pages, along with passkeys added, two-factor removed or emails changed on privileged accounts.

Read it as a list of questions. Did you make that change? Did the person named make it for a reason you know? A plugin update that you ran yourself is an answer. A role change that nobody recalls is a question worth asking. The card is described in See what changed since your last visit.

Step 3: compare the audit with an earlier day

Below it, What changed, check by check compares the current audit with the end of a recorded earlier day. Pick a day under Compared with. The card shows the score then and now and groups the checks that moved:

Opened since: checks that now have an open finding.
Severity changed: checks whose severity is different.
Passed since: checks that now pass.
Marked “doesn’t apply” since and No longer marked “doesn’t apply” since: checks you set aside, or brought back.

For a weekly look, choose the day a week ago. After a release, a migration or maintenance, choose the day before it and see which results moved with that work. The selector appears once more than one day’s audit state has been recorded. The comparison is read-only: changing the date changes only the view. See Compare audit results by day.

Step 4: look at what is unusual

When the pattern of failed sign-ins or scheduled-task timing falls well outside the preceding 30 days, the Overview shows an Unusual activity this week note. The card says what was observed against what is usual for this site, and then says: “Compared with this site’s last 30 days. This is for your information; BetterShield took no action.”

Take that at face value. The signal says activity is unusual here. It does not say why, and it does not say anyone meant harm. A burst of failed sign-ins can be a forgotten password on a team account or a script retrying. A late task can be a quiet week with few visits, because WordPress runs scheduled work when the site gets traffic. Open the linked records and compare them with what you expected. The doc is Review activity that is unusual for this site. If it holds together as a pattern you cannot explain, WordPress security incident response: a first-hour plan is the next thing to read.

Step 5: follow it into the activity record

Anything from steps 2 to 4 that you cannot explain, follow into BetterShield › Activity › Site activity. Use the category tabs, Search activity, and Filters with Who, From and To. A row can apply Everything from this person or Everything from this network, and the page address keeps your view so you can send it to a colleague.

The free plugin keeps rows for 30 days, and each finished day is sealed so an edit or a deletion opens a finding. That is also why a weekly rhythm works: the whole week is always still there. WordPress activity log: what it records and what to look for goes through what to read in a row, and the filtering guide lists every control. On a site built with a page builder, Elementor security: add-ons, code editors and file changes shows what to read in the log after an update round. If the dashboard code editors are still on, see who saved a file in the WordPress theme and plugin editor explains the High row each save leaves.

Step 6: check Site Health

If you already open Tools › Site Health each week, BetterShield’s open findings are there too, on the Status tab with a BetterShield badge, each linking to the finding. Critical findings show as critical and the rest as recommended. If the audit is more than two days old, the test says it is overdue. This is a convenience, and the findings keep their evidence and actions in BetterShield. See See BetterShield findings in Site Health.

Set it up

There is very little to set up, because most of this is already on. These are the few things worth confirming once.

Open BetterShield › Settings › Email Alerts and find What gets emailed.
Check that Send a weekly summary is on and choose a Day when someone will read and act on it.
Under Where alerts go, tick Weekly summary for each address that should receive it. With no address named, the site administration email gets it.
Select Send One Now and confirm the message arrives.
Open BetterShield › Overview once, so that the next visit has something to compare with.

The daily audit needs no setup. To refresh the results after a change, select Run an Audit Now; the audit is read-only. A person who only needs the overview, such as a client or a manager, can be set to receive the weekly summary only, with Instant alerts on None, as Choose what each address gets explains.

What it can break, and how to undo

Reading the Overview, comparing audits and filtering the activity log are all read-only. None of them changes the site, and there is nothing to undo.

The one action with a side effect is Send One Now. It sends the real summary and starts the next reporting period from that moment, so the next scheduled email will cover less. If you do not want that, wait for the scheduled one. To stop the weekly email altogether, turn off Send a weekly summary, or clear Weekly summary on an address. Clearing it on an address asks for your password when Ask for my password before removing a protection is on. Settings changes are kept in history and can be restored from there.

Check it is working

You can confirm each part in a few minutes.

Summary: select Send One Now and check that every address that should receive it did. If it says nothing was sent, an address has the weekly summary turned off.
Overview: make a small recorded change, such as a plugin update, and open BetterShield › Overview later. The card should name the event and who made it.
Comparison: choose two different dates under Compared with. The earlier score and the grouped rows should change while the current score stays the same.
Activity: apply a filter and watch the result count change. Copy the page address, open it again, and confirm the same view comes back.

Recommended settings

We recommend keeping the weekly summary on, on a day when someone will actually read it, and leaving the daily audit as it is. Keep instant alerts on for events that should not wait, so the weekly look is for patterns and not for emergencies. Compare against the day before any release or maintenance window. For a store, a membership site or a busy community, run an audit after releases and after changing access policies, as the scheduled audits guide advises.

Frequently asked questions

How often should I check WordPress security?

Once a week is a reasonable rhythm for most sites, and the weekly summary is built around it. Look sooner after a release, a migration or a change of staff, and use Compared with to pick the day before it.

Does BetterShield monitor my site all the time?

No. It audits the site once a day, records activity as it happens, and sends a summary each week. It reports what it recorded. It does not include a firewall or a malware scanner, so an empty week shows that nothing was recorded, not that nothing happened.

What if the Overview shows nothing new?

That is a normal result. The What changed since your last visit card appears when relevant changes were recorded after your last visit, and Unusual activity this week appears only when something is well outside the recent pattern. If neither shows, the summary email is still worth a glance for the score and open findings.

Does the free plugin keep the history I need?

The activity log keeps 30 days in the free plugin, which covers several weekly looks. BetterShield Ultra, a separate paid add-on, keeps longer history. The audit comparison needs recorded days, so it grows from the day you install.

Can someone else receive the summary?

Yes. Each named address has its own Weekly summary box, ticked by default, and only ticked addresses receive it. See Choose who receives alerts.

Conclusion

A weekly routine does not need new tools. Read the summary, open the Overview, compare the audit with an earlier day, and follow anything that is unusual into the activity record. BetterShield is free on WordPress.org, and the setup for the email is in Send a weekly security summary.