Failed logins and a plugin nobody remembers installing are the two earliest signals that a WordPress site is in trouble. Slack is fine for the agency channel. When you are the person who has to lock wp-admin at dinner, ntfy is the pocket.
The AlertHub plugin already watches the hooks. You do not add a second “notify ntfy” plugin. One project key in Tools → AlertHub, then paste a topic URL in Connections. Warning and critical become ntfy notifications (priority 4 vs 5). Info stays in the dashboard.
Plugin install: WordPress docs. This post is the last mile.
What should hit the phone
| Event | Hook / preset | Level | ntfy priority |
|---|---|---|---|
| Burst of failed logins | Failed login (plugin preset) | Warning | 4 |
| Admin username guessed | Failed login | Critical | 5 |
| Plugin activated / deactivated | activated_plugin / deactivated_plugin | Warning | 4 |
| Security plugin turned off | deactivated_plugin | Critical | 5 |
| Theme switched on production | switch_theme | Warning | 4 |
Do not fan every comment or new user to ntfy. Those belong in the feed as info, or in Slack — see new user and comment alerts.
Setup (once)
- Install the plugin, paste the secret key, send a test alert (failed-login guide covers the form).
- Enable the security presets: failed logins, plugin activate/deactivate, theme switch (plugin/theme guide).
- Subscribe to an unguessable ntfy topic and paste
https://ntfy.sh/YOUR_TOPICin Connections → ntfy.
The topic is the secret. Pair with uncaught PHP errors on the same project if you want fatals in the same pocket.
Alert 1: Failed logins without a Slack workspace
Keep the official preset. Use warning for a normal burst, critical if you only want admin / administrator guesses to ring (priority 5). Review the pattern in the dashboard in the morning even if you muted the phone overnight.
Alert 2: Plugin or theme change
{{0}} is the plugin file or theme name. Title examples you already use in the plugin UI still apply — ntfy just renders them as the notification body. A contractor deactivating Wordfence at 23:00 is the event Slack scrolls past and ntfy does not.
Alert 3: One topic for many client sites
Agencies: one ntfy topic, many WordPress sites. Give each site its own AlertHub project or a distinct ah_source (Client A prod, Client B staging). Filter the dashboard; do not mix twelve shops into one undifferentiated buzz.
Staging plugin experiments should stay info so they never reach ntfy.
Ideas to squeeze more value
- ntfy is not a WAF. It tells you first. You still need 2FA, a login limiter, and backups.
- Mute overnight, read the inbox. AlertHub retention and read state survive a silenced phone.
- Shop on WooCommerce? Paid orders can stay off ntfy (
info) while failed logins staywarning— or split projects. - Self-hosted Android? Same plugin, Gotify instead of ntfy.
FAQ
Does the WordPress plugin talk to ntfy directly?
No. It talks to AlertHub. ntfy is a destination on the project.
Will every failed login wake me?
If the preset is warning or critical, yes. Drop low-signal noise to info, or use a second project for staging.
Can I keep Slack for the agency and ntfy for on-call?
Yes. Same ingest, two destinations — hybrid on-call.
Next steps
Turn on the security presets, paste an ntfy topic, and fail a login on a staging site.
Related: ntfy setup · Failed WordPress logins · Plugin and theme changes