We configure logging and alerting for security-relevant events — failed login attempts, file changes, plugin activations — and because a security alert that silently stops arriving is a genuinely serious version of the monitoring ownership problem, this is the one place where we’d stress it most: noticing this has stopped working matters more here than almost anywhere else.
A silent security monitor is worse than no monitor at all
Believing you’re being alerted to suspicious activity when the alerting has actually failed is a genuinely dangerous false sense of security, arguably worse than knowing you have no monitoring and being appropriately cautious as a result. We configure this carefully and document how to confirm it’s still active, but that periodic confirmation is a security practice you need to own, not something we do for you indefinitely after this engagement ends.
Security event logging & alerting
Security event alerting configured — the one monitor where a silent failure matters most.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Access to configure logging and your chosen alerting method
- Confirmation of which specific events should trigger an alert
- Confirmation of who should receive security alerts, and through what channel, given how time-sensitive these can be
This or something else?
| You want security-relevant events logged and alerted on as they happen | This fix covers it |
| You want a broader security hardening pass, not specifically event logging and alerting | Security hardening pass – config, permissions, XML-RPC, login, in the Security, Access & Backups bucket |
| You want general PHP error logging, not security-specific event logging | Error log configuration & rotation, a different kind of logging |
| You suspect an active security incident right now, not monitoring to set up going forward | Security issues report remediation, or an urgent, different security fix instead |
What we do
- Confirm which specific security events should trigger logging and alerting
- Configure logging to capture these events with useful, actionable detail
- Set up alerting to your specified recipient through an appropriately fast channel
- Test alerting with a real, safe trigger to confirm it actually works
- Verify normal, legitimate activity doesn’t produce excessive false alerts
- Document how to periodically confirm the alerting remains genuinely active
What is included
- Security event logging and alerting configured for your specified events
- Tested confirmation using a real, safe trigger
- Verified reasonable false-alert rate
- Written documentation on confirming continued, active operation
Not included
- Ongoing, indefinite confirmation of continued operation by us — that responsibility transfers to you, and matters especially here given the stakes
- Investigating or responding to an alert once triggered — a separate, related fix or urgent engagement depending on what’s found
- Broader security hardening beyond event logging and alerting specifically, a separate, related fix
- Paying for or managing a third-party alerting service’s subscription, which remains yours directly
Questions about this fix
Why is a silent failure worse here than with other kinds of monitoring?
Because the false confidence specifically applies to security — believing you'd be alerted to a compromise attempt when you actually wouldn't be is a meaningfully more dangerous gap than, say, not knowing your uptime monitor quietly stopped, which is exactly why we're explicit about this rather than treating it the same as any routine monitoring caveat.
How often should I check that this is still working?
More frequently than you might check other kinds of monitoring, given the stakes — we'd recommend building a specific, regular habit around this rather than an occasional, casual glance.
Who actually responds if a genuine security alert comes through?
Whoever you designate to receive it — responding appropriately to a genuine alert (investigating, and engaging us or another specialist if needed) is a decision and action that happens at that time, not something pre-arranged as part of this setup.
Will this catch every kind of security event?
We configure logging for the specific events you specify and that are technically feasible to monitor, though no logging setup catches every conceivable form of compromise — this is one meaningful layer, not a complete guarantee.
What if I'm not sure who on my team should receive these alerts?
Worth deciding this deliberately before we finish setup, since a security alert with no clear, responsible recipient is functionally the same as no alert at all — we can help think through who's actually positioned to respond.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.