Most WordPress compromises do not start with a Hollywood hack. They start with a plugin nobody remembers installing, a theme switch on a live shop, or an editor who deactivated a security plugin “just for a minute.”
If you manage client sites — or a store that cannot go down — you want a ping the moment the plugin list or active theme changes. The AlertHub plugin already ships presets for these hooks. No custom PHP required.
Why this is a high-signal security alert
- Unauthorized plugin installs often precede malware. You may not watch FTP logs all day; you will notice a Telegram message.
- Deactivating Wordfence / a WAF plugin is a classic attacker (or careless contractor) move.
- Theme switches on WooCommerce sites break templates and checkout. Minutes matter.
- Agencies need a paper trail: who changed production, and when. AlertHub keeps a searchable history even if the Slack message scrolled away.
Pair this with failed login alerts and PHP fatal error monitoring for a lightweight watchdog that does not replace a full security suite — it tells you first.
Connect the plugin
Follow WordPress setup: install from WordPress.org, paste the project key under Tools → AlertHub, send a test alert.
Then connect at least one push channel: Telegram is ideal for on-call; Slack for the agency channel; WhatsApp on Pro if that is where the client lives.
Alert A: Plugin activated
| Field | Value |
|---|---|
| Hook | activated_plugin (preset in the plugin) |
| Title | WordPress plugin activated: {{0}} |
| Description | Plugin file **{{0}}** was activated on this site. If you did not do this, investigate immediately. |
| Level | Warning |
{{0}} is the plugin file path (for example wordfence/wordfence.php or hello.php).
Alert B: Plugin deactivated
This is often more important than activation. Attackers disable security plugins; developers disable caching “temporarily” and forget.
| Field | Value |
|---|---|
| Hook | deactivated_plugin |
| Title | WordPress plugin deactivated: {{0}} |
| Description | Plugin **{{0}}** was deactivated. Confirm this was intentional. |
| Level | Warning |
Alert C: Theme switched
| Field | Value |
|---|---|
| Hook | theme_switched |
| Title | WordPress theme switched: {{0}} |
| Description | Active theme changed to **{{0}}**. Check the storefront and checkout. |
| Level | Warning |
Extra hooks worth adding on production
These are not all in the preset dropdown — type them manually. Any valid WordPress action works.
| Hook | Title idea | Level |
|---|---|---|
delete_user | WordPress user deleted: ID {{0}} | Warning |
wp_update_user | (noisy — use Info or skip) | Info |
upgrader_process_complete | WordPress update finished | Info |
switch_theme | Alternative to theme_switched | Warning |
delete_user is especially useful on membership or LMS sites: an unexpected deletion is worth a phone buzz.
How agencies use this
- One AlertHub project per client (or per environment: staging vs production).
- Set the plugin source name to the client domain (
cliente.com) so the dashboard stays readable. - Invite the account manager as a project member. They see history without wp-admin access.
- Keep Info for noisy events (core updates) and Warning for activate/deactivate/theme/user-delete.
You can change Slack ↔ Telegram later from AlertHub Connections. You never reopen 40 WordPress dashboards to paste a new webhook.
What this is not
AlertHub is not a malware scanner, file-integrity monitor, or firewall. Keep Wordfence, Patchstack, or your host WAF. This layer answers a different question: did someone change the site while I was not looking?
FAQ
Will theme/plugin updates flood me?
Updates typically fire upgrader_process_complete, not activated_plugin. Activation alerts fire when something is turned on, which is rarer and more suspicious.
Can I see who did it?
The default hooks pass the plugin file or theme slug, not the current user. Check WordPress activity logs (or a lightweight audit plugin) after the AlertHub ping tells you when to look.
Does it work on WordPress.com / managed hosts?
If you can install plugins from WordPress.org, yes. Some locked-down hosts restrict custom plugins — test with the built-in Send Test Alert button.
Next steps
Install the plugin from the WordPress guide, add the three alerts above, and route them to Telegram. The next surprise plugin will not be a surprise.
Related: WooCommerce order alerts · new user and comment alerts