A security alert is useful only if you know what to do with it. BruteBank alerts give you the context around a WordPress login attempt so you can separate routine noise from a real risk and respond before a password becomes an entry point.

Start with the result

Look at whether the attempt failed or succeeded. Repeated failed attempts usually indicate a bot trying credentials against your login page. A successful login that you do not recognize needs immediate investigation, especially if it came from a new location or device.

ALERT TRIAGE
FAILED + REPEATED → monitor / block
SUCCESS + UNKNOWN → investigate now
2FA REQUEST → verify the person

Read the surrounding details

The username tells you which account was targeted. The IP address helps you identify repeated activity and compare alerts over time. The timestamp lets you match the alert to changes in your site, hosting logs, or a team member’s activity. Location data is a useful signal, but it is not proof on its own because VPNs and mobile networks can change apparent locations.

When an alert is probably routine

A series of failed attempts against common usernames, with no successful login and no site changes, is often automated brute-force traffic. Leave blocking enabled, make sure the targeted accounts have strong unique passwords, and watch for a change in pattern.

When to act immediately

  • A successful login does not match a known person or session.
  • An administrator account, email address, or password changed unexpectedly.
  • A new user, plugin, theme, or scheduled task appeared without approval.
  • A two-factor code was requested when nobody on your team was signing in.

Reset the affected credentials, revoke unknown sessions, remove unauthorized users, and inspect recent file changes. If you suspect a full compromise, preserve evidence and contact your host or a WordPress security professional.

Use alerts to improve the baseline

Patterns matter more than any one notification. If the same account is targeted every night, reduce exposure around that account and confirm it is protected with 2FA. If activity comes from a concentrated range of addresses, blocking and rate limiting can reduce the noise. If alerts increase after a plugin install, review that plugin and its update history.

BruteBank gives you the signal. Your job is to know the expected behavior of your site so the unexpected stands out.