Security Events
Last updated: 10th July 2026 for CC Security Essentials Pro version 1.0
Introduction
Understanding what is happening on your website is an important part of maintaining good security.
CC Security Essentials Pro can record selected security-related events, helping authorised administrators review important activity without relying on external monitoring services.
Security Events are intended to provide useful operational information while remaining privacy-conscious and easy to understand.
They are not intended to replace a dedicated server audit log or enterprise security information system.
What Are Security Events?
Security Events record selected activities that may be useful when reviewing the security of your website.
Examples include:
- repeated failed login attempts;
- temporary login restrictions;
- blocked REST API requests;
- password-related security events.
Each event helps provide context about activity on the website without requiring constant manual monitoring.
Why Record Security Events?
Most websites operate normally for long periods without requiring any security investigation.
When an unexpected issue occurs, however, Security Events can help administrators answer questions such as:
- Have repeated login attempts occurred?
- Has REST API Protection blocked requests?
- Are users repeatedly triggering Login Protection?
- Has Password Change Enforcement been activated?
Reviewing recent events often provides valuable context when investigating unexpected behaviour.
Viewing Security Events
Open:
Security → Security Events
The page displays the most recent recorded events together with relevant information to help administrators understand what occurred.
Depending on the event type, information may include:
- the time of the event;
- the event type;
- the affected user (where applicable);
- the originating IP address (where appropriate);
- additional context describing the event.
The exact information recorded depends upon the type of event.
Event Types
CC Security Essentials Pro records only selected security-related events.
Examples include:
Login Protection
Events generated when Login Protection temporarily restricts repeated failed login attempts.
Password Management
Events associated with password age monitoring and Password Change Enforcement.
REST API Protection
Events generated when REST API Protection blocks unauthorised visitor requests.
Where REST Rules are being used, these events can also help identify routes that may require further review.
Reviewing Events
Security Events are intended to support informed decision-making rather than immediate alarm.
For example:
Repeated failed login attempts from a single address may indicate an automated password guessing attempt.
Occasional failed logins from a known administrator are usually nothing more than typing mistakes.
Review events in context before taking action.
Searching and Reviewing Activity
When reviewing events, consider:
- whether activity is repeated;
- whether it affects privileged accounts;
- whether the same IP address appears repeatedly;
- whether the activity relates to expected website usage.
Looking for patterns is generally more useful than focusing on isolated events.
Relationship with Other Features
Security Events complement several other Pro features.
Login Protection
Login Protection can generate events when temporary restrictions occur.
Reviewing these events can help identify repeated attacks or users experiencing authentication problems.
REST Rules
Blocked REST API requests may indicate that a legitimate integration requires additional configuration.
The Route Tester should be used before creating new Allow Rules.
Password Management
Password-related events can help administrators understand when password changes have occurred or when Password Change Enforcement has been triggered.
Best Practice
Review Security Events periodically rather than only after a problem occurs.
When investigating unusual activity:
- Review recent Security Events.
- Confirm whether the activity is expected.
- Review Security Health.
- Run relevant Verification checks.
- Adjust configuration only if genuinely required.
This measured approach often avoids unnecessary configuration changes.
Privacy
Security Events are designed with privacy in mind.
Information remains on your website.
The plugin does not send security events to external services.
Only information required for security administration is recorded.
Depending on the event type, recorded information may include:
- user identifiers;
- IP addresses;
- timestamps;
- REST API routes;
- event descriptions.
The plugin does not record passwords or other authentication secrets.
Administrators should review local data-retention requirements and remove older records when they are no longer required.
Common Questions
Will every login be recorded?
No.
Security Events focus on significant security-related activity rather than recording every routine action performed on the website.
Are Security Events sent anywhere?
No.
All recorded information remains on your website unless you choose to export or share it.
Can Security Events replace server logs?
No.
Security Events provide useful WordPress-level information.
Server logs remain the most appropriate source for low-level web server activity.
The two can complement one another when investigating an issue.
Should I keep Security Events forever?
Not usually.
Retaining security information for an appropriate period is generally more useful than keeping it indefinitely.
Your retention period should reflect your operational and legal requirements.
Troubleshooting
I can’t see any events
Confirm that:
- CC Security Essentials Pro is active;
- Security Events are enabled;
- relevant security activity has occurred.
Some websites may experience very little security-related activity during normal operation.
Too many similar events are being recorded
Repeated events often indicate repeated activity.
Rather than ignoring them, investigate the underlying cause.
For example:
- incorrect saved passwords;
- automated login attempts;
- misconfigured integrations;
- unnecessary REST API requests.
Resolving the cause is generally preferable to simply clearing the event history.
I don’t recognise an IP address
An unfamiliar IP address does not necessarily indicate malicious activity.
Visitors, search engines, uptime monitoring services and legitimate integrations may all generate requests.
Review the event type and surrounding activity before drawing conclusions.
Related Articles
Continue with: