WordPress live traffic monitoring
The Live console shows requests, firewall blocks and sign-ins as they reach the site. It's where you look when something feels wrong: a burst of blocked requests, a run of failed sign-ins, or one address that keeps coming back.
For a closer look, full-traffic capture records every request with its response status, the signed-in user if there was one, and the firewall's verdict. It is a rolling window, not a permanent record: rows are kept for 12 hours. Query values that look like passwords, tokens or keys are replaced with "[redacted]" before anything is stored.
The console is always available. Full-traffic capture is off by default; switch it on for an investigation.
A WordPress security monitoring plugin that sums up the week
Once a week you get one short email: the site's security score, what the firewall stopped, the week's settings changes and who made them, and anything that needs you. A quiet week says so. If you haven't set any alert recipients, it goes to the site's admin email.
The summary has its own switch, separate from event alerts, so you can keep it while leaving per-event emails off.
On by default.
WordPress security alerts by email
Event alerts are off until you switch them on, so a new install doesn't fill your inbox before you've decided what you want to hear about. Once they're on:
- stopped attacks, such as locked-out sign-ins and firewall blocks, go into one daily summary, sent only if anything happened;
- an "as they happen" mode sends them individually, at most once a day per attacker per kind of alert, 5 an hour and 20 a day; the rest roll into the daily summary;
- some events always email at once: an admin signing in from somewhere new, a new admin account, protection weakened, files changed, card testing at the checkout, and password guessing that nothing is stopping.
Off until you switch email alerts on. The daily summary is then the default for stopped attacks.
What each alert shows
Every alert says who was involved and from where: the user, the IP address, its location and network, and the device, browser and operating system. You can usually tell from the email alone whether it was you on a new laptop or someone else.
Settings-change emails are sent only when they matter: when a change weakens protection, when nobody was signed in, or when an administrator who isn't one of the plugin's owners made it. A weakening change shows the value before and after.
Unusual admin sign-ins
When an administrator signs in from a network that account has never used, WP SecureGate logs it, and emails you once if alerts are on. A new device or an unusual hour adds to a sign-in risk score, which starts counting after a warm-up of 5 sign-ins. An alert also fires when an administrator account is written straight into the database, a common sign of a break-in. More on sign-in protection in login security.
Detection on by default. Blocking high-risk sign-ins is off by default and never blocks admins.
The card-testing alert
On WooCommerce shops, the card-testing alarm watches failed payments across the whole shop. When it goes up, it records one alert, "Card testing on your shop", emailed to you if alerts are on. The details are on card-testing protection.
On by default. Emailed only when alerts are on.
How to monitor WordPress security over time
Live traffic is for right now. For the longer view, the activity log keeps 90 days of sign-ins, settings changes and security events, each entry chained to the last so a deleted or altered one can be found.
Activity log on by default.
Part of WP SecureGate: Activity log →