Alerts and reports

SafeHouse tells you about problems in four places: alert e-mails, the activity log, notices in wp-admin, and Tools → Site Health. This page lists what goes where, so you know where to look and what you will never be e-mailed about.

Alert e-mails

Recipients

Alert e-mails go to the addresses in SafeHouse → General → Alert recipients: "Comma-separated. Empty means the site admin address." SafeHouse drops invalid addresses and duplicates when you save.

When someone changes the site's admin e-mail address, the alert also goes to the previous address, so that a takeover of that setting does not go unnoticed.

What is e-mailed

Subject (after "[SafeHouse] Site name: ")	Sent when	Module
new administrator	An account with administrator rights is created, or a user gets the administrator role	Change alerts
site setting changed	Someone changes "Anyone can register", the default role, the admin e-mail, the WordPress address or the site address	Change alerts
changes detected	The hourly check finds new or removed administrators, plugins, themes, must-use plugins or drop-ins, a plugin switched on or off, a changed wp-config.php, or a watched setting changed outside WordPress	Change alerts
2 known vulnerabilities in installed software	New findings appear after a vulnerability data download	Vulnerability alerts
Account jan paused for new devices	An existing account is paused after many failed logins, if E-mail when an account is paused is on	Login limits
installs unlocked	Someone unlocks plugin and theme installs	Install lockdown

The e-mails are plain text. Each one ends with the site address, a link to the SafeHouse settings page and the signature "SafeHouse, Design House". They are sent with WordPress's wp_mail(), so the SMTP mail module delivers them when it is on.

What is never e-mailed

These go only to the activity log, Site Health or the settings page:

• address lockouts by Login limits
• blocked bot submissions
• Plugin health findings
• blocked install attempts, and installs locking again
• rejected update or vulnerability data
• failed Cloudflare cache clearing
• failed mail delivery

Activity log

The activity log records changes and security events: settings changes, lockouts, blocked installs, alerts, updates. It does not record ordinary visits.

Where to see it

• SafeHouse settings page: the Activity log panel shows the last 50 entries. Each shows the message, the event code (blue for info, yellow for warning, red for critical), the user, how long ago (hover for the exact UTC time) and the address.
• WP-CLI: wp shouse log --limit=100 shows up to 500 entries. See Command line reference.

There is no export, filter or paging in wp-admin.

What it stores

Each entry has the time (UTC), an event code, a severity (info, warning or critical), the user, the visitor address, a message and some context. Context values whose names look like passwords, secrets, tokens, keys, cookies, nonces, hashes or salts are stored as [redacted]. Entries older than 90 days are deleted every day.

The address comes from the same logic as everywhere else in SafeHouse, so set up the proxy in front of the site to see real visitor addresses instead of the proxy's.

Event codes

Event	Written when
settings_changed	SafeHouse settings are saved, with the modules that changed
safe_mode	Safe mode is turned on or off with WP-CLI
admin_added	An administrator is created or promoted
option_changed	A watched site setting changes
inventory_changed	The hourly Change alerts check finds changes
inventory_accepted	The current state is accepted as the new baseline
login_locked	An address is locked out
login_paused	An account is paused for new devices
login_unlocked	Someone lifts lockouts
bot_blocked	Bot protection blocks a submission (repeats for the same form and reason are not logged for 10 minutes)
install_blocked	Install lockdown blocks a plugin or theme install
lockdown_unlocked, lockdown_locked	Installs are unlocked or locked again
vulnerability_found	Vulnerability alerts finds new vulnerabilities
advisories_rejected	Vulnerability data fails its signature or checksum check
update_verified	A SafeHouse update package passed its signature and checksum check
update_rejected	A SafeHouse update was refused
scripts_changed	Header and footer scripts change
maintenance	Maintenance mode is switched on or off
mail_failed	Mail delivery fails (at most once every 10 minutes)
mail_test	Someone sends an SMTP test e-mail
cache_purged	Someone clears the LiteSpeed page cache by hand
cloudflare_purged, cloudflare_purge_failed	SafeHouse clears Cloudflare's cache, or Cloudflare refuses
object_cache	The Redis object cache is enabled or disabled with WP-CLI

Notices in wp-admin

Notice	Who sees it	Where
"Security vulnerability in installed software", with up to five urgent findings, Go to updates and All findings	Users who can update plugins or WordPress	Every wp-admin screen, until the software is updated or removed. It cannot be dismissed.
"SafeHouse safe mode is on: every module is stopped. …"	Administrators	Every wp-admin screen while safe mode is on
"Maintenance mode is on"	Administrators	The admin bar, while Maintenance mode runs
The result of a button such as Check now	The user who selected it	Once, on the next screen

Urgent means a CVSS score of 7 or higher, or no fixed version yet. All findings, urgent or not, are on the SafeHouse settings page and in Site Health.

Site Health

SafeHouse adds these checks to Tools → Site Health. Each one appears only while its module runs. Site Health lists each result under a heading that describes it, such as "Login limits block password guessing" or "Some plugins need attention". Each result carries a Security or Performance badge.

Check	Module	Reports
SafeHouse registration check	Hardening	An admin-level default role for new accounts (critical), or open registration (recommended)
SafeHouse login limits	Login limits	Whether login limits can block by address on this server
SafeHouse plugin health	Plugin health	Closed, abandoned and forgotten plugins
SafeHouse vulnerability alerts	Vulnerability alerts	Known vulnerabilities in installed software, or missing vulnerability data
SafeHouse and Cloudflare	Shown when the site is set up for Cloudflare or a request comes through Cloudflare	Whether SafeHouse sees real visitor addresses behind Cloudflare
SafeHouse LiteSpeed page cache	LiteSpeed page cache	Whether LiteSpeed serves pages from its cache
SafeHouse Cloudflare cache	Cloudflare cache	"Cloudflare refused to clear the cache"; shown only after Cloudflare refused a request
SafeHouse object cache	Redis object cache	Whether the SafeHouse object cache reaches Redis; shown only while its drop-in is installed

Related pages

• Troubleshooting
• Data and privacy
• Change alerts
• Vulnerability alerts