I am a Wordfence user managing multiple websites, and I rely heavily on automated scans with email alerts configured for “High” severity or greater. My goal is to stay informed about critical vulnerabilities while avoiding unnecessary notifications for lower-severity issues.
However, I have noticed that Wordfence categorizes every vulnerability as “Critical” in its scan results, regardless of the actual CVSS severity level. For example, I recently received an alert for a plugin vulnerability rated 4.9 (Medium) CVSS, which applies only to “Authenticated (Administrator+)” users. While this is noteworthy, it does not warrant a “Critical” designation under typical severity classifications, and I would not expect an email notification when my preferences are set to “High” or greater. This approach results in frequent notifications for low-level vulnerabilities, which dilutes the importance of truly critical alerts. For some time, I believed this behavior was a bug, but I understand now that it is by design.
Would it be possible to introduce an option to align scan result severity with CVSS ratings or allow users to filter email alerts more precisely based on CVSS levels? This change would significantly improve the relevance of email notifications for users like me who manage a large number of sites.
Thank you for considering this request, and I look forward to hearing your thoughts.
]]>Hello,
I have automatic backups configured on Google Drive with UpdraftPlus, and I have the following message in the confirmation of my last backup : “Latest status: The backup was successful (with alerts) and is now complete”
Thank you in advance for your help.
]]>We’ve noticed that the Sucuri plugin still tries to send email alerts even when there are no email addresses in the list of recipients. And, when sending a “Test Email” from the Alerts settings page, it will reload the page and say it was sent successfully, which of course cannot be true.
This is triggering a WP_Error when it happens (presumably because Sucuri is calling wp_mail but not providing a To: address.)
Below is a WP_Error object that we logged; this dev site happened to be using the Fluent SMTP plugin (Configured to send outbound mail through Mailgun), but the issue is the same regardless.
WP_Error Object
(
[errors] => Array
(
[wp_mail_failed] => Array
(
[0] => Mailgun API Error
)
)
[error_data] => Array
(
[wp_mail_failed] => Array
(
[to] => Array
(
[0] =>
)
[subject] => Sucuri Alert, dev.local, Test Email Alert, 127.0.0.1
[message] =>
Event: Test Email Alert
Website: https://dev.local
IP Address: 127.0.0.1
Reverse IP: dev.local
Date/Time: July 25, 2024 4:21 pm
User: andrew
Message: Test email alert sent at July 25, 2024 4:21 pm
[headers] => Array
(
)
[attachments] => Array
(
)
[phpmailer_exception_code] => 400
)
)
[additional_data:protected] => Array
(
)
)
Thanks!
]]>WooCommerce developers claim that these post update notifications are not related to anything that they have changed in their plugin, so I do not understand why these post updates (once being performed silently) are now resulting in e-mail alerts.
How do I configure Sucuri alert preferences so that I am not receiving notifications for these two post updates (new -> wc-pending and wc-pending -> wc-processing)?
Thank you.
]]>Really love this plugin and use it on 120+ sites.
That means that every time there is an update available, I get 120+ emails telling me about that.
I know I can unsubscribe from these email notifications, but after unsubscribing, my email is completely removed in WordFence email notifications settings.
I do want to keep getting alerts when administrators are users log in and when there are high level attempts to log in etc.
How can I achieve that please?
Thanks,
Annie
Steve & Ralph are phenomenal developers and product managers. I have made a crazy-number of feature requests and suggestions, and most have already been incorporated (or are at least on the roadmap).
I can’t say enough good things about the two of them — they epitomize the absolute best of the WordPress ecosystem!
]]>