Failed logins are one of the earliest signals that someone is probing your WordPress site. A handful of mistakes from a real user is normal. A burst of attempts on admin, administrator, or random usernames is usually a brute-force attack.
WordPress emails about this are easy to miss. With the official AlertHub plugin you can turn every failed login into an alert that lands in Slack, Telegram, WhatsApp, email, or the AlertHub dashboard — with a searchable history.
This guide shows you how to set it up in a few minutes.
Why failed-login alerts matter
- You see attacks as they happen, not days later in a security plugin report.
- You know which username they tried. That tells you if they are guessing
adminor targeting a real editor. - You can act immediately: enable 2FA, lock the account, change the login URL, or block the IP at the host/WAF.
- The whole team can see it. Route
warningalerts to a shared Slack or Telegram channel instead of one person’s inbox.
AlertHub stores every event in a live feed. Even if you mute notifications at night, you can review the pattern in the morning.
What you need
- A free AlertHub account and a project (copy the One-Way Secret Key).
- The AlertHub plugin installed from WordPress.org.
- Optional: a destination such as Slack, Telegram, or WhatsApp (WhatsApp is on paid plans).
Full plugin setup: WordPress integration docs.
Step 1: Connect WordPress to AlertHub
- In WordPress, go to Plugins → Add New, search for AlertHub, install and activate.
- Open Tools → AlertHub.
- Paste your project secret key and (optionally) a source name such as
Production WP. - Click Save Settings, then Send Test Alert.
If the test appears in the dashboard, you are ready to create rules.
Step 2: Alert on wp_login_failed
WordPress fires the wp_login_failed action every time a login fails. The first argument is the username that was attempted.
- Go to Tools → AlertHub → Alerts.
- Click Add New.
- Configure:
| Field | Value |
|---|---|
| Active | Checked |
| WordPress Hook | wp_login_failed (preset: Failed Login) |
| Title | Failed WordPress login: {{0}} |
| Description | Someone tried to sign in as **{{0}}** and failed. Check if this is a user typo or a brute-force attempt. |
| Level | Warning |
- Click Save Alert.
{{0}} is the username. Using Warning (not Info) is important: AlertHub stores info alerts in the dashboard but only forwards warning and critical/error to Slack, Telegram, WhatsApp, and other channels.
Step 3: Pair it with successful logins
Failed attempts are the smoke. A successful login on a privileged account is the fire.
Create a second alert on wp_login:
| Field | Value |
|---|---|
| Hook | wp_login |
| Title | WordPress login: {{0}} |
| Description | User **{{0}}** signed in successfully. |
| Level | Info for everyday users, or Warning if you only want push notifications for admins (see tips below). |
We also have a dedicated walkthrough: Get notified of every WordPress login.
How to get more out of this
Watch for targeted usernames
If you see repeated failures for admin and you already renamed that account, it is almost certainly automated scanning. If you see failures for a real editor’s email, treat it as a credential-stuffing attempt against that person.
Keep noise down
- Use Warning for failed logins so they reach your phone.
- Use Info for successful logins if volume is high (a busy membership site), and only raise admin logins to Warning.
- Create a dedicated AlertHub project per site (
Staging,Client A,Shop) so you can mute one site without silencing the others.
Combine with destinations your team already uses
One WordPress plugin, many channels. Connect Slack for the team, Telegram for on-call, and email as a backup. Change the destination later without editing WordPress.
Add PHP fatal-error monitoring
Login alerts will not help if a plugin update whitescreens the site. Pair this setup with uncaught PHP error alerts.
FAQ
Does this slow down WordPress?
No. The plugin sends alerts asynchronously (blocking => false), so a slow notification never blocks the login response.
Can I include the IP address?
wp_login_failed only passes the username by default. You can still see the username and timestamp in AlertHub. For IP-level blocking, use this alert as the trigger to check your host firewall, Cloudflare, or a security plugin log.
What if I manage several WordPress sites?
Use a different source name per site in plugin settings, or a separate AlertHub project. The dashboard filters by source and project.
Next steps
- Create a free AlertHub project.
- Follow the WordPress plugin guide.
- Connect Telegram or Slack so failed logins reach you in seconds.
Related: WooCommerce order alerts · Plugin and theme security alerts