Get alerts for failed logons — WordPress, scripts, and email

Failed logons are an early probe signal. WordPress has a hook for that. A VPS often has only auth.log and a script. A security appliance may only send mail. AlertHub does not invent a Windows Event Log collector or a Fail2ban plugin. It accepts the same three ingest paths the rest of the product already uses: the WordPress plugin, the Ingestion API, and email ingest.

The dedicated WordPress walkthrough (preset, {{0}} username, pairing with wp_login) is failed WordPress login alerts. ntfy last mile: WordPress security on ntfy. This post is the hub: several origins, one project, ah_source so a brute-force on the shop does not look like an SSH scrape on the VPS.

Only warning and critical reach Slack, Telegram, WhatsApp, and the rest. Info is dashboard-only.

Three ways a failed logon becomes an alert

Origin	Ingest	Source label	Level
WordPress	Plugin hook `wp_login_failed`	Shared name in Tools → AlertHub (e.g. `Production WP`)	Warning
Anything that can `curl`	`POST https://api.thealerthub.com/sendAlert`	`ah_source` such as `sshd` or `VPS`	Warning or critical
Tool that only emails	Forward to `{key}@warning.sendalert.thealerthub.com`	Always `Email:` + From	Warning (from the address)

Do not mix staging WordPress failures into the production project. Mute one site by muting one project.

Setup (once)

Create a project at app.thealerthub.com and copy the secret key.
Connect Telegram or Slack if the phone should buzz.
Add one origin from the table. Confirm a test row, then add the next.

Origin 1: WordPress (plugin)

Install AlertHub from WordPress.org. Tools → AlertHub → Alerts → Add New, hook wp_login_failed (preset Failed Login), title Failed WordPress login: {{0}}, level Warning. {{0}} is the username the attacker tried. The plugin sends asynchronously (blocking => false).

Full form and FAQ (IP is not in the default hook args): failed WordPress login alerts. Plugin history: Tools → AlertHub → History.

Origin 2: A command you already run

If Fail2ban, PAM, or a cron that greps auth.log already executes a command on failure, that command can be curl — same contract as the bash webhook guide. AlertHub has no Fail2ban jail of its own.

curl -X POST https://api.thealerthub.com/sendAlert \
  -H "Content-Type: application/json" \
  -d '{
    "ah_key": "'"$ALERTHUB_KEY"'",
    "ah_title": "Failed logon",
    "ah_description": "Host detected a failed logon. Check auth logs.",
    "ah_level": "warning",
    "ah_source": "sshd"
  }'

Keep the secret in ALERTHUB_KEY, not in the jail file committed to git. Do not claim fields WordPress or sshd did not pass; if you want a username in the title, your script must send it as JSON and reference it with {{username}} (custom variables — Ingestion API).

Origin 3: Forward the mail you already get

Many security plugins and firewalls email “failed login” and have no webhook. Inbox rule: trusted sender only → {YOUR_KEY}@warning.sendalert.thealerthub.com. Subject becomes the title. Spec: email ingest. Treat the address like a key.

Prefer HTTP when the host can POST, so the secret does not appear in mail logs.

Ideas to squeeze more value

Successful logins are a different hook. wp_login at info (or warning for admins) — WordPress login notifications.
Plugin/theme changes belong next to failed logins on WordPress, not in the sshd source — plugin and theme security.
WhatsApp quota. A noisy wp_login_failed at warning will drain Pro WhatsApp. Use Telegram, or keep WordPress at warning and leave WhatsApp off that project.
This is not a WAF. 2FA, a login limiter, and the host firewall still matter.

FAQ

Can AlertHub read Windows Event ID 4625?
Not as a native source. If a Windows tool already emails you, use email ingest. If a script can POST JSON, use the Ingestion API.

Does the WordPress plugin talk to Telegram directly?
No. Plugin → AlertHub → your Connections.

Will every typo wake me?
If the WordPress alert is warning, yes. Staging project at info, or review the inbox in the morning and mute the channel overnight — inbox.

Next steps

Turn on wp_login_failed at warning, then add a curl from the host or a forward rule — not both for the same WordPress site.