Notifications and Reports (WordPress & WooCommerce) — Immediate Emails, Digest, Queue and Deliverability

Objective

This article explains how to configure and use Securantis email notifications on WordPress (with WooCommerce where applicable): enable immediate alerts, receive the summary digest, understand the send queue and improve deliverability.

Quick facts

• Immediate alerts are disabled by default; the weekly digest is recommended for most sites.
• Notifications are queued and retried automatically on failure. After several attempts a message moves to a permanent failure state.
• A send test is available to verify configuration without generating a real alert.
• Securantis does not automatically delete or restore detected files: any action on quarantine requires a human decision.

Prerequisites

• Administrator access to the site’s WordPress dashboard.
• A valid recipient email address (by default: the site administrator email).
• WP Cron working or an external cron configured if you handle large volumes or a daily-hosting environment.

Where to act (summary)

• Open the Securantis Notifications page in the WordPress admin.
• Enable notifications if needed, enter the recipient address and save.
• Send a test email to validate the configuration.
• Check the metrics (sent, pending, failures) and the list of recent notifications.

Detailed steps

1. Check the initial state

1. Go to the Securantis Notifications page in the WordPress admin. There you will see whether notifications are active or disabled, the recipient address used and metrics (sent over 7 days, pending, failures over 7 days, last send).
2. Note the displayed address (by default the site admin address) and the status of the send queue.

2. Enable immediate alerts or keep the digest

1. If you choose to enable immediate alerts, toggle the corresponding switch on the Notifications page.
2. For most sites, we recommend keeping the weekly digest and enabling only certain critical alerts based on your needs (for example automatic IP blocking, file quarantine, or sensitive WooCommerce events).

3. Set/Change the recipient

1. Enter the desired recipient email address (prefer a group address or a monitoring mailbox, not an unsupervised personal account).
2. Save the configuration.

4. Send a test

1. Use the Send test option available on the notifications page to validate the send chain. The test indicates whether WordPress confirmed the send. Never share your passwords by email.
2. If the test returns an error, proceed to the troubleshooting section below.

5. Understand the send queue and states

• Notifications are recorded in an internal queue with statuses: queued, retry, sent, failed.
• Each notification includes a deduplication key to avoid near-duplicate messages.
• A periodic worker processes the queue and sends messages. The plugin triggers several hooks: a send worker and a digest hook.

Expected outcome

• The send test should be confirmed by WordPress. The metric “Sent over 7 days” increases if the send is properly confirmed.
• Critical messages appear in the queue and then move to “sent” if completion is confirmed.
• In case of a transient error, messages move to “retry” and will be retried automatically.

Cautious settings and recommendations

• Prefer a monitored recipient address (group alias, ticketing system or dedicated mailbox). Avoid using unsupervised personal addresses.
• If you enable immediate alerts, configure filters to receive only important categories (e.g. file quarantine, IP blocking, WooCommerce payment anomalies).
• Keep a weekly summary digest if multiple people need to be informed but not for every single event.

Deliverability: best practices

1. Use a reliable transport

• Install and configure an SMTP plugin (e.g. WP Mail SMTP, Post SMTP) to authenticate sends via your provider (SendGrid, Mailgun, Amazon SES, hosting provider) instead of PHP mail().

2. Authentication and alignment

• Configure SPF, DKIM and DMARC for the sending domain to improve inbox trust.
• Use a From address that exists and belongs to the same domain (avoid third-party generic addresses).

3. Content and reputation

• Ensure the domain and IP have no spam history. Critical alerts should clearly indicate the sender and the subject.
• Ask recipients to mark the address as “safe” if messages land in spam.

Common errors and their causes

• Send test fails (WordPress did not confirm the send): often related to PHP mail() configuration, hosting-side blocking or a bad recipient address.
• Messages blocked or in spam folder: missing SPF/DKIM, unauthenticated sender, suspicious content or poor IP reputation.
• Send queue does not clear: WP Cron may be inactive or the worker is not running regularly.
• High number of failures over 7 days: the recipient mail rejects or filters messages, or your sending server is rate-limited.

Step-by-step troubleshooting

1. Check WP Cron

• If your hosting does not run wp-cron reliably, configure a system cron to trigger wp-cron.php every 5–15 minutes.

2. Test sending via SMTP

• Temporarily install an SMTP plugin and configure an external transport (e.g. Mailgun, SendGrid, Amazon SES). Send a test from that plugin and from Securantis to compare.

3. Examine logs

• Check the SMTP plugin send logs (or PHP error logs) to find error messages returned by the SMTP server.

4. Inspect the send queue

• From the Notifications page, check the number of pending and failed messages. If many accumulate: manually trigger the cron worker (or execute the worker hook via WP-CLI if you are comfortable with WP-CLI).

5. Verify DNS configuration

• Check SPF, DKIM, DMARC using an online tool. Correct DNS records at your registrar/DNS provider.

Precautions and limits

• Do not automatically delete failed messages without investigation: a failure may hide a changed recipient address or a provider block.
• Do not send credentials or passwords by email. Any intervention requiring privileged access must follow the paid intervention procedure and be done via the secure client area.

When to contact Securantis support

Contact support if:

• The send test fails despite SMTP correctly configured and WP Cron operational.
• The send queue does not progress despite manually running the worker.
• Critical messages (quarantine, compromise) do not reach the appropriate recipients.

Provide to support:

• The subject and result of the send test.
• The metrics visible on the Notifications page (pending, sent 7d, failures 7d, date of last send).
• The results of SPF/DKIM/DMARC checks and, if possible, anonymized SMTP logs (without passwords).

Final notes

Notification management combines application aspects (activation, queue, test) and infrastructure aspects (SMTP transport, DNS, cron). First perform simple checks (SMTP test, cron) before engaging in deeper intervention.

If you enable immediate alerts, clearly define who will receive them to avoid alert fatigue. If uncertain, prefer the weekly digest and contact our support with the requested information.