Too many emails from your WordPress security plugin? What a useful alert looks like

If your security plugin sends you several emails a day, you have probably stopped reading them. That is the real cost of too many alerts: the message about a new administrator account arrives between twenty lockout notices and gets deleted with them. The plugin should write less often and say more when it does, and most of that is a matter of settings.

Why security plugins send so much

Most of the volume comes from a few habits:

• One email per event. Every blocked login, every lockout, every plugin update and every changed file is its own message. Any site on the internet gets login attempts from bots every day, so this alone can mean dozens of emails.
• The same problem again and again. An outdated plugin that you cannot update this week is reported after every scan.
• Weak signals treated as findings. Code that decodes base64 or calls eval appears in many legitimate plugins. A scanner that reports each occurrence turns the site's normal code into a list of suspects.
• Failures reported as problems. When the scanner cannot reach WordPress.org for checksums, some tools report every file as unverified, and the next scan "fixes" them all again.

A failed login from a bot is not news. Lockouts of random user names are background noise that every site on the internet has, and the lock has already done its job.

What a useful alert looks like

Take your last few alerts and check each one against this list:

1. It is about something new, or something that got worse. A problem you already know about does not need a second email.
2. It says what, where and how serious. The file, the plugin or the account, and a severity that tells you whether it is today's job.
3. It says what to do. One or two steps, or who to forward it to.
4. It says how sure it is. "Malicious code matched in this file" and "this file is unusual, ask someone who knows the site" are different messages and should look different.
5. It links to the screen where you act.
6. It comes in one batch. One email per scan that lists everything new beats ten emails from the same scan.

If you know what to do within a minute of opening it, the alert works. If you have to log in to find out whether it matters at all, it is noise.

What deserves an email at once

A short list of events needs a message straight away, because waiting for the next scan costs something:

• an account became administrator,
• failed logins are locking an administrator's account, which means someone is aiming at that account,
• a scan found malware or changed WordPress files, with clear evidence.

The rest can wait for the email after a scheduled scan or for a weekly summary: available updates, low-severity hints, lockouts of user names that do not exist on the site.

How to tune any security plugin

These steps work whichever plugin you use.

1. Count for a week. Make a folder or label for the plugin's mail and see what arrives and how often. Note which emails actually led to doing something.
2. Raise the threshold. Most plugins have a minimum severity for email. Start with serious problems only, and lower it once the list of open problems is short.
3. Stop emails about ordinary lockouts. Keep the lock and drop the email. Keep alerts about administrator accounts if the plugin treats them separately.
4. Send alerts to someone who acts on them. If your developer fixes the problems, add their address. Check that no address on the list belongs to someone who no longer works with you.
5. Ignore what was changed on purpose, one item at a time. A file someone edited deliberately can be marked as known. Make sure the plugin reports it again if it changes later, or every ignore becomes a blind spot.
6. Send a test email and look in the spam folder. An alert in spam is as useless as one nobody reads. If yours land there, ask whoever runs your mail to check how the site sends email. SPF, DKIM and DMARC explained covers the records involved.
7. Do not route alerts into a folder you never open. If you would rather read them once a week, turn on a summary instead.

Silence needs a check too. If no email has arrived for months, send a test and look in the plugin's screen for the date of the last scan. A scan that stopped running sends nothing either.

When an alert is wrong

A false positive is a finding about something that is fine. Before you ignore it:

• open the finding and read which file or setting it names,
• if it is a WordPress, plugin or theme file, compare it with a fresh copy of the same version,
• ask the person who built the site whether they changed it,
• report it in the plugin's support forum on WordPress.org, with the name of the check and what you see.

Do not turn off a whole check because of one wrong finding. The next real one would go unreported.

How Ensomedia Security handles alerts

This is how the code and the readme of Ensomedia Security describe its alerts:

• One email per scan, only about problems that are new or got worse at or above the threshold you set, and at most four a day. Whatever goes over the limit waits for the next email. A scan you start yourself with Scan now sends no email, since you are already looking at the result.
• Three thresholds in Settings, under Email alerts: Critical only, Serious (the default) and Also smaller ones. Send to takes up to five addresses, and Send a test email shows whether they arrive.
• At once when an account becomes administrator, and when an administrator's user name gets locked after failed logins. Lockout emails stop at three a day per site.
• A weekly summary every Monday, off until you turn it on.
• A check that could not run never sends email and never marks anything as fixed, so an outage at WordPress.org stays quiet.
• Uncertain findings never send email. They go under Ask your developer to check. One weak signal, such as base64 in a file, is never a finding, and only findings with high confidence are emailed.
• Ignore keeps a finding out of the score and the alerts, and an ignored file comes back if it changes again.

Every check, the daily scheduled scan (03:00 site time by default) and the email alerts are free and work without an account. The plugin page has the details.

Check your site from the outside. Enter your address at shieldwave.io. It takes about 90 seconds and needs no password and no plugin.