WordPress Admin Login Alerts: Know When Someone Changes Your Site
Security tools keep people out. The question they rarely answer in real time is who just got in and what they changed — admin logins, plugin switches, theme changes, rogue registrations — as a phone push instead of a Friday audit.
WordPress Admin Login Alerts: Know When Someone Changes Your Site
Most WordPress security advice is about keeping people out: strong passwords, two-factor, a firewall plugin. All correct. But there's a second question security tools rarely answer in real time: who just got in, and what did they change? An admin login from a country you've never been to, a plugin that appeared at 3 a.m., a theme switch nobody planned — these are the moments where a five-minute heads-up is worth more than a monthly audit log.
Here's the set of site events worth a push notification, why the built-in tools don't deliver them, and how to wire them up in a few minutes.
The five events that deserve a phone buzz
- An administrator logged in. Not every login — every admin login, with the IP. If it's you, you glance and move on. If it isn't, you know in seconds instead of at the next audit.
- A plugin was activated or deactivated. New plugins are how compromised sites get their backdoors; deactivated ones are how security plugins get silenced. Either way, someone with admin access made a change — you should know who.
- The theme was switched. Rare and dramatic. Legitimate once a year; alarming the rest of the time.
- A new user registered. On sites with registration enabled, a burst of new accounts is the classic spam-bot signature; on sites where registration should be off, a single one is a red flag.
- An automatic update failed. Not an intrusion, but a silent way for a site to fall behind on security patches while everyone assumes auto-updates are handling it.
Notice the theme: none of these are "attacks." They're changes — and the ability to see changes as they happen is what turns a security incident from a forensic reconstruction into a two-minute phone call.
Why the built-in tools don't cover this
WordPress logs almost nothing about logins by default, and activity-log plugins (which are excellent) record events into a dashboard — a place you visit weekly, if that. The failure mode isn't missing data; it's latency. A log you check on Friday cannot tell you about Tuesday night until Friday. Email notifications from security plugins help, but they land in the same inbox as everything else and get muted the first time a legitimate login triggers one.
The useful shape is: quiet by default, a phone push for the handful of events above, and enough deduplication that your own logins don't become noise.
Setting it up
The FlowAlert WordPress plugin has a Site events card with a toggle for each of the five: admin logins (deduplicated to one alert per admin per hour, so your own morning login is one buzz, not fifty), plugin changes (with the name of the plugin and who did it — and it ignores its own activation), theme switches, new registrations, and failed auto-updates. Each one is an ordinary alert: routed by your rules, acknowledged so the team can see someone looked, escalated if nobody does. A sensible routing setup sends admin logins and plugin changes to whoever owns the site at high priority, and registrations at normal priority where quiet hours apply — you want the 3 a.m. plugin activation to make a sound, and the 3 a.m. newsletter signup not to.
It's not a firewall or a malware scanner — keep those. It's the layer they don't have: the phone that buzzes when the site changes, which is the moment you can still do something about it.
