Alert the Site Owner When an Administrator's Email or Password Changes
Emails the site's admin address whenever any administrator account changes its email address or password, a key warning sign of an account takeover.
Snippet Library
Security snippets for WordPress
Snippets that harden WordPress: turn off XML-RPC, hide the version number, stop user enumeration, add security headers and block risky uploads. Small, reviewable changes for site owners who want fewer attack points without a heavy security plugin.
Daily Email Summary of Failed Logins
Counts failed login attempts during the day (per username and IP address) and emails the administrator a short summary each morning, so you notice brute-force attacks without a flood of alerts.
Detect Administrator Accounts Added Behind Your Back
Keeps a list of approved administrator accounts and checks it daily and on every dashboard visit; administrators that appear any other way (for example inserted directly into the database by malware) trigger an email and a warning with an approve button.
Email Alert When Plugins Are Activated or Deactivated
Emails the site administrator whenever a plugin is turned on or off, with who did it and when.
Email Alert When a New Administrator Appears
Emails the site owner whenever an account is created as, or promoted to, administrator, which is often the first sign of a compromise.
Email Alert When an Administrator Logs In
Sends an email to the site admin address every time an administrator account logs in, with the time, IP address and browser.
Email Alerts When Application Passwords Are Created
Emails the user and the site administrator whenever a new application password is created for an account, since these passwords give API access that bypasses the normal login.
Warn About a Public debug.log File
Alerts administrators when WordPress writes errors to wp-content/debug.log, a file anyone can usually download and read.