Quiet hours, limits and digests

What it does

Quiet hours: between the times you set, non-critical alerts are held for the digest or not sent.

Rate limit: no more than a set number of alerts per hour, day or week. Extra alerts are combined into the hourly summary, queued, or dropped.

Digests: the Daily Security Digest arrives every morning at 08:00 and the Weekly Security Digest on Monday at 08:00, site time. They show failed sign-ins, lockouts, bans and blocked requests with the change against the period before, the addresses with the most failed sign-ins, new administrators and role changes, changed files and new malware findings, updates and findings still waiting, how old the last good backup is, the security score and how it moved since the last digest, and any alerts held back. A section with nothing in it is left out.

Digest Contents: Show addresses in digests (on by default) lists the five busiest addresses; off, the digest gives counts only and no address appears in it. When nothing happened sends a one-line "All quiet" digest (the default, so silence never looks broken) or nothing at all.

Why it matters

If every alert pings your phone, you soon stop reading them. Delivery rules make the important emails stand out.

Set it up

1. On the Notifications tab, section Delivery, open Delivery Rules.
2. Switch on quiet hours, set the start and end, and choose what happens to alerts during them.
3. Switch on the rate limit, set the number and period, and choose what happens when it is reached.
4. In the Alerts matrix, switch on the daily or weekly digest under Reports.
5. In Digest Contents, choose whether addresses are shown and what happens on a quiet day or week.
6. Click Save Changes.

Good to know

Critical alerts ignore quiet hours and the rate limit, so a lockout or malware alert always gets through.

During quiet hours, "Only send critical alerts" and "Don't send any notifications" have the same effect today, because critical alerts are always sent.

An alert set to Digest only is sent in the hourly summary when no digest is switched on, so it is never lost.

A digest template you edited before keeps working as saved. The new sections are extra placeholders, such as {{top_addresses}}, {{changes_list}} and {{todo_list}}, that you can add to it, or click Reset and save to bring back the default with every section.

New administrators and role changes come from the activity log, so they only show when activity logging records user and role changes.

Lockouts count each address locked out once. Blocked requests count whole days (UTC) before the digest is sent. Failed sign-ins and lockouts can only be compared with the period before while sign-in records are kept that long: two days for the daily digest, two weeks for the weekly one. With the default of 7 days the weekly digest says there is no earlier record to compare.

Alerts held for the digest stay queued until a digest carrying them is sent, so a failed send does not lose them. A successful sign-in clears the failed sign-in records of that address and username, so they no longer count in the digest.

Timed emails rely on WordPress's scheduler, which runs when the site has visitors. On very quiet sites, ask your host to set up a real scheduled task.

Which plan includes it

Delivery rules and digests are part of Pro.