- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
Security monitoring helps identify suspicious activity before it becomes prolonged damage.
Logs should answer who did what, when, from where and whether the action succeeded.
Events Worth Monitoring
Depending on the website, monitor:
- Successful and failed logins.
- Password resets.
- New users and role changes.
- New application passwords.
- Plugin and theme installation.
- Updates and file changes.
- Changes to critical settings.
- Unexpected administrator creation.
- Form abuse.
- REST API errors.
- PHP and server errors.
- WAF or CDN security events.
- Backup success and failure.
Protect the Logs
Logs can contain usernames, addresses, paths, tokens and personal data.
Restrict access, define retention and prevent public download. Avoid logging passwords, session cookies, full authorization headers or unnecessary form contents.
Centralization
If an attacker can modify the same server and its local logs, evidence may be lost.
Important sites can send selected logs to a separate protected service.
Alerts
Alerts should identify events that require action.
Too many low-value alerts create fatigue. Prioritize privilege changes, unusual logins, integrity failures, malware findings and monitoring outages.
Baselines
Understand normal traffic, login locations, update timing and scheduled jobs.
A baseline helps distinguish routine automated activity from meaningful anomalies.
Review Process
Define:
- Who reviews alerts.
- Expected response time.
- Escalation path.
- Evidence preservation.
- False-positive handling.
- Incident record format.
Monitoring without ownership is only storage.
Frequently Asked Questions
Should every WordPress action be logged?
Not necessarily. Collect events that support security, operations and investigations while respecting privacy and storage limits.
Can debug.log act as a security log?
It can provide useful errors but is not a complete audit trail and must not be publicly accessible.
Continue Learning
Previous: [Spam and Form Security](/resources/wordpress-manual/security/spam-form-security/)
Next: [How to Check WordPress for Malware](/resources/wordpress-manual/security/check-wordpress-malware/)