WordPress Login Alert Email

Two, each switched on separately. The first goes out when a login attempt is blocked by your rules, and gives the IP address, the country, the reason for the block — geographic restriction, manual blocklist, too many failed attempts, outside allowed hours — and the exact time. The second is the new IP login alert: it arrives when a sign-in succeeds from an address never seen before, with the username, country and time. The plugin remembers the last five hundred known addresses, so it doesn’t write to you every time you log in from the same place.

No, because they are limited to one every thirty minutes per IP address: an attack trying a thousand passwords doesn’t produce a thousand emails. There is one deliberate exception. If the password used was correct and only your rules stopped the attempt, the limit doesn’t apply and the email goes out immediately, under a different subject line. A rejected attempt is noise; a rejected attempt with working credentials means somebody has them, and you need to know right then.

First check that a destination address is set: without one, the notification isn’t even generated. Then remember that sending goes through WordPress’s wp_mail() function, so delivery depends on your server’s mail configuration. If your site sends without aligned SPF and DKIM records, messages land in spam or get rejected outright. The plugin’s mail log tells you whether the message was accepted by the mail server or failed, and with which error.

Yes, the destination is a separate field. That’s the right choice when you run sites on someone else’s behalf: the alerts reach you, while your client keeps receiving only the emails that genuinely concern them. Security notifications are a working tool for whoever maintains the site, not a source of alarm for whoever simply uses it.