Security incident detection for WordPress

What it does

A raw activity log tells you everything and therefore nothing. The incident engine correlates events inside a time window and recognizes the shapes that matter: brute-force attacks, privilege escalation, backdoor installation, plugin compromise, and the hostile-takeover sequence: an admin login followed by security-plugin deactivation and a suspicious file upload.

How it works

Detection runs two ways: significant events trigger an immediate check, and a scheduled pass analyzes the last hour of activity. When a pattern matches, the engine creates an incident that bundles the related events, de-duplicates against incidents already open for the same pattern, and attaches per-type remediation recommendations.

Alerts go where your team already is: email, Slack, Discord, Microsoft Teams, Telegram, PagerDuty or any custom webhook, with per-incident-type alert rules. There is a REST API for incidents and a WP-CLI surface for scripting.

• Brute force, privilege escalation, backdoor installation, plugin compromise, hostile takeover
• Event-triggered and hourly scheduled analysis
• Incidents bundle related events with remediation recommendations
• Per-type alert rules across 6 platforms
• REST API and WP-CLI access