Documentation

Current as of V1.1.0

"Knowledge is power."
— Francis Bacon

Installation

Get Sentinel up and running on your WordPress site in minutes with our comprehensive security monitoring solution.

System Requirements

Before installing Sentinel, ensure your WordPress site meets these requirements:

  • WordPress: Version 5.0 or higher
  • PHP: Version 7.4 or higher
  • MySQL: Version 5.6 or higher
  • Memory: Minimum 64MB PHP memory limit
Note: Sentinel is designed to work with all modern WordPress themes and plugins. It uses WordPress best practices and doesn't conflict with other security plugins.

Method 1: WordPress Repository (Coming Soon)

Once approved on WordPress.org, you'll be able to install directly from your admin dashboard.

WordPress Admin
Navigate to Plugins → Add New → Search for 'Sentinel' → Install & Activate

Method 2: Manual Installation

Download and install the plugin manually for immediate access.

  1. Download the plugin ZIP file from our download page
  2. Go to Plugins → Add New → Upload Plugin
  3. Choose the downloaded file and click Install Now
  4. Activate the plugin after installation
Success: After activation, Sentinel will automatically create its database tables and begin monitoring your site immediately with default settings.

Post-Installation Checklist

After installing Sentinel, complete these essential steps:

1

Verify Installation

Check that "Sentinel" appears in your WordPress admin sidebar

2

Review Default Settings

Visit Sentinel → Settings to review and customize default configurations

3

Test Monitoring

Perform some actions on your site to verify events are being logged

Quick Setup

Configure Sentinel in under 5 minutes with these essential steps to start monitoring your WordPress site immediately.

1. Access the Dashboard

After activation, navigate to Sentinel in your WordPress admin sidebar. You'll see a comprehensive dashboard with real-time activity monitoring.

Tip: Sentinel starts monitoring immediately after activation with sensible defaults. No additional configuration required to begin tracking essential security events.

2. Review Event Settings

Visit Sentinel → Event Registry to customize which events to track. This is where you can enable or disable specific monitoring features based on your security needs.

Default Events Tracked
• User logins/logouts

• Content creation/editing

• Plugin/theme changes

• Failed login attempts

• Admin actions

• File modifications

• Database changes

• Security events

3. Configure Alerts

Set up email notifications for critical security events. Go to Sentinel → Settings → Notifications Tab → Compliance & Monitoring to have sentinel send you an email when a critical security event occurs.

Important: Sentinel defaults to your WordPress admin email address. You can change this in the Sentinel → Settings → Notifications Tab → Notifications & Alerts section.

4. Test the System

Perform some test actions on your site to verify that Sentinel is properly logging events:

  • Log out and log back in
  • Create or edit a post
  • Change a setting in your admin panel
  • Check the activity log to see these events recorded

First Steps

Essential actions to take after installing Sentinel to maximize your security monitoring effectiveness.

1

Review Activity Log

Check Sentinel → Activity Log to see real-time monitoring data. This gives you immediate visibility into all user activities on your site.

2

Tailor Your Monitoring

Visit Sentinel → Event Registry to customize which events to track. This is where you can enable or disable specific monitoring features based on your security needs.

3

Optimize Performance

Adjust log retention and cleanup settings in Sentinel → Settings → Log Management. Set appropriate retention periods based on your compliance requirements.

4

Set Up User Permissions

Configure which user roles can access Sentinel features in Sentinel → Settings → Privacy & Security Tab → Access Control & Security. Restrict access to administrators and trusted editors only.

5

Enable Privacy Features

Configure GDPR compliance features in Sentinel → Settings → Privacy & Security Tab. Enable IP anonymization and data export capabilities.

Pro Tips for New Users

Start Small: Begin with default settings and gradually customize based on your specific security needs. This prevents overwhelming yourself with too many alerts initially.
Regular Reviews: Make use of the daily and weekly digests to stay on top of your security and monitoring needs and tailor to your needs.
Backup Strategy: Consider exporting your logs regularly for long-term storage and compliance purposes, especially for sites with high security requirements.

General Settings

Configure Sentinel's core functionality and behavior to match your security monitoring requirements.

Basic Configuration

Access general settings via Sentinel → Settings → Log Management Tab → Log Management & Retention. These settings control the fundamental behavior of the monitoring system.

Setting Description Default Recommended
Auto-Cleanup When enabled, old logs will be automatically moved to archive or deleted based on the settings below. Enabled Enabled
Age Limit Archive logs older than this many days. (Minimum: 1 day, Maximum: 10 years) 90 days 90 days
Entry Limit Archive logs when total entries exceed this number. (Minimum: 100, Maximum: 1,000,000)r 10000 10000
Cleanup Schedule How often to check for logs that need cleanup. Daily Daily
Archive Retention How long to keep archived logs before permanent deletion. 1 year 1 year
Database Optimization Optimize database tables to maintain performance and reduce storage space. Enabled Enabled
Optimization Schedule How often to run database optimization. Weekly Weekly

Advanced Configuration Options

Fine-tune Sentinel's behavior with these advanced settings. These options provide more granular control over the monitoring system's behavior and performance.

Setting Description Default Recommended
Data Anonymization Automatically anonymize IP addresses and user data for privacy compliance. Disabled Based on privacy policy
IP Address Logging Enable to track IP addresses in activity logs for security monitoring. Enabled Based on privacy policy
Role-Based Log Access When enabled, editors will only see user, content, and authentication events. Admins see all events. Disabled Moderation Policy Based
Audit Log Access When enabled, Sentinel will log whenever a user views the logs or dashboard, including who, when, and from where. Disabled Based on privacy policy
Right to be Forgotten Enable GDPR Article 17 compliance - users can request deletion of their personal data from logs. Disabled Based on privacy policy
Data Portability Enable GDPR Article 20 compliance - users can export their personal data in machine-readable format. Disabled Based on privacy policy
Batch Processing Process logs in batches to reduce server load. Larger batches are more efficient but use more memory. 1000 entries 500-2000
Right to be Forgotten Enable shortcode functionality allowing users to request data deletion. Provides GDPR compliance through [sentinel_data_deletion_request] shortcode. Disabled Based on privacy policy

Performance Considerations

Optimize Sentinel's performance based on your site's traffic and requirements:

High-Traffic Sites: Consider reducing log retention to 30 days and enabling automatic cleanup to prevent database bloat.
Low-Traffic Sites: You can safely extend log retention to 180 days or more for comprehensive audit trails.

Event Registry

Configure which events Sentinel should track and monitor to create a comprehensive security audit trail. The Event Registry is organized into distinct sections for different types of monitoring capabilities.

Event Registry Structure

The Event Registry is organized into three main sections to help you manage different types of monitoring:

1

🔌 3rd Party Plugin Integrations

Available to all users. Monitor popular WordPress plugins like WooCommerce, Contact Form 7, and Gravity Forms with pre-configured event templates and one-click setup.

2

📊 System Events Registry

Available to all users. View and control all registered WordPress core events, plugin events, and system activities with detailed filtering and management options.

3

➕ Custom Events Management

Sentinel+ feature. Create and manage custom events for business-specific monitoring needs, third-party integrations, and specialized tracking requirements.

Available Event Types

Sentinel tracks and logs a comprehensive range of events that range from PHP errors to WordPress core events. Below is a list of some of what Sentinel tracks. This is not a comprehensive list as most events are self-explanatory.

Authentication Events

Core Security
user_login User logged in successfully
user_logout User logged out
failed_login Failed login attempt
password_reset Password reset requested

User Management

Account Changes
user_registered New user registration
user_deleted User account deleted
role_changed User role modified
profile_updated User profile modified

Content Management

Site Content
post_published Post published
post_updated Post modified
post_deleted Post removed
comment_approved Comment approved
media_uploaded File uploaded

System & Security

Core Changes
plugin_activated Plugin enabled
theme_switched Theme switched
core_upgraded WordPress core upgraded
option_updated WordPress option or setting changed
php_fatal_error PHP error occurred
Complete Event List: The Event Registry in your WordPress admin (Sentinel → Event Registry) contains the full list of all available events with detailed descriptions, severity levels, and usage statistics. You can enable/disable individual events and customize their monitoring behavior there.

Event Configuration Options

Each event type in the Event Registry includes these configuration options:

Status Toggle

Enable or disable monitoring for each event type individually

Severity Levels

Set priority as Low, Medium, High, or Critical based on security importance

Usage Tracking

Monitor how often each event occurs and when it was last triggered

Detailed Information

View comprehensive details about each event including descriptions and metadata

Performance Options

While Sentinel is designed to be extremely lightweight with minimal impact on your site, proper optimization ensures it stays that way regardless of your site's traffic volume or activity level.

Performance First: Sentinel typically adds less than 50ms to page load times and uses minimal server resources. However, optimizing these settings for your specific environment ensures optimal performance as your site grows.

Batch Logging Configuration

Control how Sentinel processes and stores log entries to balance performance with real-time visibility.

Setting Description Recommended Values Performance Impact
Enable Batch Logging Queue logs and write them in batches instead of immediately Enabled for high-traffic sites Significantly reduces database writes
Batch Size Number of logs to process in each batch 50-100 for most sites, 200+ for high-traffic Higher = better performance, more memory usage
Batch Frequency How often to process batched logs (in seconds) 60s standard, 30s for real-time needs Lower = more frequent processing
Trade-off: Batch logging improves performance but introduces a slight delay in log visibility. Choose based on whether you need real-time monitoring or can accept 30-60 second delays.

Rate Limiting & Spam Prevention

Protect your site from log spam and potential abuse while maintaining comprehensive monitoring.

Setting Purpose Recommended Values Use Case
Per-Minute Limit Maximum events logged per minute 100-200 for normal sites Prevents log flooding during attacks
Per-Hour Limit Maximum events logged per hour 1000-5000 based on site activity Long-term protection against sustained attacks
Rate Limiting Behavior How to handle events when limits are exceeded Graceful Degradation (recommended) Maintains visibility while reducing load

Rate Limiting Behaviors Explained

Graceful Degradation
Recommended

Samples every 10th event when over limit to maintain visibility while reducing load

Hard Blocking
Aggressive

Completely stops logging until the next time window (most resource-efficient)

Priority Only
Selective

Only logs critical and error events, blocks warning/info events

Smart Memory Monitoring

Prevent memory-related crashes and optimize resource usage with intelligent memory management.

Feature Description Default Setting Recommended For
Memory Monitoring Tracks memory usage patterns and provides optimization recommendations Enabled All sites, especially shared hosting
Memory Threshold Percentage of PHP memory limit before logging is paused 80% Adjust based on site's memory usage patterns
Smart Recommendations Analyzes usage patterns and suggests optimizations Enabled Sites wanting automated optimization guidance
Memory Leak Detection Sentinel+ feature. Advanced algorithm detects potential memory leaks by analyzing usage patterns across multiple requests with confidence scoring and smart filtering to reduce false positives. Disabled (Premium) Sites experiencing unexplained memory growth or performance degradation

Performance Optimization by Site Type

Recommended configurations for different types of WordPress sites:

1

Small Personal/Blog Sites

Settings: Batch logging disabled, standard rate limits (100/min, 1000/hour), memory threshold 80%

Reasoning: Low traffic allows real-time logging without performance impact

2

Business/Medium Traffic Sites

Settings: Batch logging enabled (50 logs/60s), moderate rate limits (200/min, 3000/hour), memory threshold 75%

Reasoning: Balance between real-time visibility and performance optimization

3

High-Traffic/E-commerce Sites

Settings: Batch logging enabled (100+ logs/30s), high rate limits (500/min, 10000/hour), memory threshold 70%

Reasoning: Maximum performance with comprehensive monitoring for critical business operations

4

Shared Hosting

Settings: Conservative batch logging (25 logs/120s), lower rate limits, memory threshold 85%

Reasoning: Resource constraints require careful optimization to avoid hosting limits

Monitoring Performance Impact

Use Sentinel's built-in performance monitoring to ensure optimal operation:

Usage Statistics

Monitor per-minute and per-hour event rates to optimize rate limiting settings

Memory Analysis

Track memory usage patterns and receive automated optimization recommendations

Smart Recommendations

Receive personalized suggestions based on your site's actual usage patterns

Pro Tip: Start with conservative settings and gradually optimize based on your site's actual performance metrics. The Settings page shows real-time usage statistics to help you make informed adjustments.

Memory Leak Detection (Sentinel+)

Overview

Advanced memory leak detection uses sophisticated algorithms to identify potential memory leaks before they cause serious performance issues or crashes.

Sentinel+ Feature: Memory leak detection is available only to premium users to reduce false positive noise for free users.

How It Works

1

Pattern Analysis

Monitors memory usage across multiple requests, tracking increases and consistency patterns to identify potential leaks.

2

Confidence Scoring

Uses advanced algorithms to calculate confidence scores (0-100%) based on consistency, magnitude, and frequency of memory increases.

3

Smart Filtering

Only alerts when confidence exceeds 70% to minimize false positives from normal memory fluctuations.

4

Cooldown Protection

Implements 6-hour cooldown periods to prevent alert spam while ensuring critical issues are still reported.

Alert Types

Confidence Level Alert Type Description Recommended Action
90%+ Critical Very high confidence this is a real memory leak Immediate investigation required
70-89% Warning Potential memory leak detected Monitor and investigate within 24 hours
<70% No Alert Insufficient confidence for leak detection Continue monitoring

Recommendations Provided

When a memory leak is detected, Sentinel provides context-specific recommendations:

  • Urgent Actions: Identify recently changed code, enable debug logging, check for infinite loops
  • Investigation Steps: Review activated plugins, check data processing operations
  • Optimization Tips: Review image processing, implement pagination, optimize caching strategies

Privacy Settings

Sentinel provides comprehensive privacy and data protection features to help you comply with GDPR, CCPA, and other data protection regulations while maintaining effective security monitoring.

Legal Disclaimer: These tools help facilitate compliance with data protection regulations, but you are responsible for ensuring your implementation meets all applicable legal requirements in your jurisdiction. Consider consulting with legal professionals for compliance verification.

IP Anonymization

Sentinel's intelligent anonymization system masks personally identifiable data in security logs while preserving analytical value for security monitoring and traffic analysis.

How IP Anonymization Works

When triggered (either automatically through deletion requests or manually via admin tools), Sentinel processes IP addresses using a sophisticated masking system:

Address Type Original Format Anonymized Format Preserved Information
IPv4 192.168.55.200 192.168.xxx.xxx Network/subnet identification
IPv6 2001:db8::1234:5678 2001:db8::xxxx:xxxx Network prefix for geolocation
Already Masked 10.0.xxx.xxx 10.0.xxx.xxx No changes (prevents double-masking)
Smart Processing: Sentinel automatically detects already-anonymized IP addresses to prevent double-processing and maintain data integrity.

Anonymization Benefits

Privacy Protection

Removes personally identifiable information while maintaining security monitoring capabilities

Analytics Preservation

Keeps network-level data intact for traffic analysis and security pattern detection

Compliance Ready

Meets GDPR Article 4 requirements for data anonymization and pseudonymization

Security Controls

Sentinel+ provides advanced security controls that enable intelligent threat detection, automated response actions, and sophisticated IP management. These features transform Sentinel from a monitoring tool into an active security protection system.

Sentinel+ Feature: Advanced security controls require a premium license. Includes intelligent threat detection, automated response actions, IP allowlist management, and incident handling.

Security Response Mode

Configure how Sentinel+ responds to detected security threats using the intuitive 3-way toggle control. This setting determines the system's behavior when thresholds are exceeded.

Response Mode Behavior Use Case Recommendation
Observe Only Log security incidents without taking automated action Testing and baseline establishment Start here for new installations
Throttle Threats Add configurable delays to suspicious login attempts Slowing down attacks while preserving access Good balance of security and usability
Block Threats Temporarily block IP addresses that exceed thresholds Maximum protection for high-risk environments Recommended for production sites
Best Practice: Start with "Observe Only" mode for 1-2 weeks to establish baseline behavior and avoid blocking legitimate users. Monitor the incident log to tune thresholds before enabling active protection.

Detection Thresholds

Configure sensitivity levels for different types of security threats. These settings determine when Sentinel+ considers an activity suspicious enough to trigger an incident.

Brute Force Detection

Monitors repeated login failures from the same IP address within a specified time window.

Setting Default Range Description
Failed Attempts 5 3-20 Number of failed login attempts before triggering incident
Time Window 5 minutes 1-60 minutes Time period within which attempts are counted

User Enumeration Detection

Detects attempts to discover valid usernames through login form probing or author page scanning.

Setting Default Range Description
Enumeration Attempts 10 5-50 Number of username discovery attempts before incident
Detection Window 10 minutes 5-60 minutes Time period for counting enumeration attempts

XML-RPC Protection

Monitors XML-RPC endpoint for abuse including brute force attacks and DDoS attempts.

Setting Default Range Description
Request Limit 20 10-100 Maximum XML-RPC requests before incident
Time Period 5 minutes 5-60 minutes Window for counting XML-RPC requests

IP Allowlist Management

Configure IP addresses and ranges that should bypass all authentication limits and security checks. This is essential for preventing lockouts of legitimate users and systems.

Allowlist Configuration

Enter IP addresses or CIDR ranges in the allowlist textarea, one per line. Supports both individual IPs and network ranges:

Example IP Allowlist Configuration
# Office network
192.168.1.0/24

# VPN server
203.0.113.5

# CDN ranges
198.51.100.0/24
203.0.113.0/24

# Localhost variants
127.0.0.1
::1

CIDR Notation Examples

CIDR Range Covers Common Use
192.168.1.0/24 192.168.1.1 - 192.168.1.254 Office network
10.0.0.0/8 10.0.0.1 - 10.255.255.254 Large private network
172.16.0.0/16 172.16.0.1 - 172.16.255.254 Corporate VPN
203.0.113.5 203.0.113.5 only Single server IP
Security Note: Be cautious when allowlisting broad IP ranges. Overly permissive allowlists can compromise security. Regularly review and audit your allowlist entries.

Response Settings

Configure how Sentinel+ responds when security incidents are detected based on the selected response mode.

Throttle Response

When "Throttle Threats" mode is active, add configurable delays to suspicious requests:

Setting Default Range Purpose
Throttle Delay 3 seconds 1-10 seconds Delay added to suspicious login attempts

Block Response

When "Block Threats" mode is active, temporarily block IP addresses that exceed thresholds:

Setting Default Options Recommendation
Block Duration 1 hour 5 minutes - 24 hours Start with shorter durations, increase as needed

Admin Trust Mode

Reduce false positives by temporarily bypassing security checks for admin users after successful authentication.

Setting Default Options Description
Trust Admin IPs Disabled Enabled/Disabled Bypass detection for admin IPs after successful login
Trust Duration 24 hours 1-24 hours How long to trust admin IPs after authentication
Use Case: Admin Trust Mode is particularly useful for administrators who frequently trigger detection thresholds through legitimate administrative activities.

Incident Management

Configure automatic incident resolution and notification rate limiting to prevent alert fatigue while maintaining security awareness.

Setting Default Options Purpose
Auto-resolve Incidents 6 hours 30 minutes - 24 hours Automatically resolve incidents after specified time
Notification Cooldown 30 minutes 5 minutes - 1 hour Minimum time between duplicate incident notifications

Troubleshooting Security Controls

Common issues and solutions for security control configuration and operation.

Why are legitimate users getting blocked?

Common causes:

  • Detection thresholds set too low for normal usage patterns
  • Admin or power users not included in IP allowlist
  • Shared IP addresses from office or corporate networks
  • VPN or proxy services triggering multiple user detection

Solutions:

  • Add office/VPN IP ranges to allowlist using CIDR notation (e.g., 192.168.1.0/24)
  • Enable Admin Trust Mode for administrative users
  • Increase detection thresholds gradually while monitoring incidents
  • Start with "Observe Only" mode for 1-2 weeks to establish usage baselines

Why isn't my IP allowlist working?

Common causes:

  • Incorrect CIDR notation formatting
  • Leading or trailing whitespace in IP entries
  • Mixing IPv4 and IPv6 formats incorrectly
  • Using ranges that don't include your actual IP address

Solutions:

  • Validate CIDR notation using online calculators before adding
  • Use one IP address or range per line with no extra spaces
  • Test with single IP addresses first before using broad ranges
  • Check the incident log to see if your IP is being flagged incorrectly
  • Check that your public IP hasn't changed (dynamic IPs)

I'm getting too many false positive incidents. How do I reduce them?

Common causes:

  • Detection thresholds too sensitive for your site's normal traffic
  • Normal user behavior patterns not accounted for
  • Automated systems, bots, or monitoring tools included in detection
  • Mobile users or shared connections triggering multi-user scenarios

Solutions:

  • Increase thresholds gradually while monitoring incident patterns
  • Add known service IPs (monitoring, CDN, backup services) to allowlist
  • Use longer detection windows for better accuracy (10-15 minutes instead of 5)
  • Enable notification cooldown to reduce alert frequency
  • Review incident logs to identify patterns before adjusting settings

Security controls aren't activating - incidents logged but no action taken?

Common causes:

  • Security Response Mode still set to "Observe Only"
  • All or most traffic being allowlisted unintentionally
  • Detection thresholds set too high to ever trigger
  • Premium license not active for advanced security features

Solutions:

  • Verify response mode is set to "Throttle Threats" or "Block Threats"
  • Review allowlist entries for overly broad ranges (avoid 0.0.0.0/0)
  • Lower thresholds temporarily to verify system operation
  • Check incident log for "action taken" vs "observed only" entries
  • Confirm Sentinel+ license is active and validated

How can I test if security controls are working?

Safe testing methods:

  • Check the Activity Log for allowlist bypass confirmations
  • Check the Incident Log for recent security events and actions taken
  • Temporarily lower thresholds and monitor for expected incidents
  • Review activity logs for throttling delays or blocked requests

Testing tips:

  • Start testing in "Observe Only" mode to see detection without blocking
  • Use a different device or network for controlled testing
  • Monitor debug logs for security control activation messages
  • Test during low-traffic periods to minimize impact on real users
Testing Tip: Monitor the incident log and activity logs to verify IP allowlist configuration is working correctly. Start with "Observe Only" mode to test detection without blocking.

Data Deletion Request

Implement GDPR "Right to be Forgotten" functionality using the [sentinel_data_deletion_request] shortcode.

Overview

The data deletion request feature allows users to request the removal of their personal data from Sentinel's logs and databases, helping you comply with GDPR Article 17 (Right to Erasure).

GDPR Compliance: This feature helps satisfy the "Right to be Forgotten" requirement under GDPR, allowing users to request deletion of their personal data.

Implementation

Add the shortcode to any page where users can request data deletion:

Basic Implementation
// Add to your privacy policy page or dedicated deletion request page

[sentinel_data_deletion_request]
Coming Soon - Feature in Development
Advanced Configuration
// Customize the deletion request form

add_filter('sentinel_data_deletion_form', function($form_html, $user_id) {

    // Customize form appearance or add additional fields

    return $form_html;

}, 10, 2);



// Handle pre-deletion actions

add_action('sentinel_before_data_deletion', function($user_id) {

    // Perform any necessary actions before data deletion

    // e.g., notify administrators, log the request

});



// Handle post-deletion actions

add_action('sentinel_after_data_deletion', function($user_id) {

    // Perform any necessary actions after data deletion

    // e.g., send confirmation email, update external systems

});

What Gets Deleted

When a user requests data deletion, Sentinel will remove the following data:

User Activity Logs

Account Events
user_login Login/logout attempts
profile_updated Profile changes
post_created Content creation and edits
comment_posted Comment activities

Personal Information

PII Data
ip_address IP addresses (if not anonymized)
user_agent User agent strings
session_data Session data
custom_metadata Custom user metadata

Administrative Data

System Records
deletion_request Deletion request records
audit_trail Audit trail entries
notification_prefs Notification preferences
user_settings User-specific settings
Important: Data deletion is permanent and cannot be undone. Consider implementing a confirmation step and backup procedures.

Best Practices

Follow these guidelines when implementing data deletion requests:

1

Clear Communication

Explain what data will be deleted and the implications of the deletion request

2

Verification Process

Implement proper user verification to prevent unauthorized deletion requests

3

Confirmation Step

Require explicit confirmation before proceeding with data deletion

4

Audit Trail

Maintain records of deletion requests for compliance and security purposes

Legal Compliance: Ensure your implementation meets all applicable data protection regulations in your jurisdiction. Consider consulting with legal professionals for compliance verification.

3rd Party Plugin Integrations

Sentinel provides comprehensive monitoring for popular WordPress plugins with automatic detection and one-click setup templates. These integrations are available to all Sentinel users (both Basic and Sentinel+) and require no additional configuration once enabled.

Available in Sentinel Basic: All third-party plugin integrations are included in the basic version of Sentinel. No upgrade required to monitor your plugin activities.

Supported Integrations

Sentinel automatically detects and provides monitoring templates for the following popular WordPress plugins:

WooCommerce

Track orders, payments, inventory changes, and customer interactions with comprehensive ecommerce monitoring.

Contact Form 7

Monitor form submissions, track failures, and analyze user engagement with your contact forms.

WPForms

Track form submissions, payment completions, and user interactions across all your WPForms.

Gravity Forms

Monitor form submissions and payment completions with detailed tracking and analytics.

Key Features

Automatic Plugin Detection
One-Click Setup Templates
Pre-configured Event Templates
Granular Event Control
Detailed Activity Logging
Real-time Monitoring

How It Works

Sentinel's third-party plugin integrations work seamlessly with your existing plugins:

1

Automatic Detection

Sentinel automatically detects when supported plugins are active on your WordPress site.

2

One-Click Setup

Navigate to Sentinel → Event Registry → 3rd Party Plugin Integrations and click the setup button for your detected plugins.

3

Automatic Monitoring

Events are automatically created and enabled. Sentinel begins logging plugin activities immediately.

4

Granular Control

Enable or disable specific events, view detailed logs, and customize monitoring to match your needs.

WooCommerce Integration

Monitor your online store with comprehensive ecommerce event tracking. WooCommerce integration is available in both Sentinel Basic and Sentinel+ with automatic detection and one-click setup templates.

Available in Sentinel Basic: WooCommerce integration is included in the basic version of Sentinel. No upgrade required to monitor your online store activities.

Overview

WooCommerce Integration provides comprehensive monitoring of your online store activities. Track orders, payments, inventory changes, and customer interactions with automated event logging that requires no additional configuration once enabled.

Order Management

Order Management

4 Events
woo_new_order New order placed by customer
woo_payment_complete Payment successfully processed
woo_order_status_changed Order status updated
woo_payment_failed Payment processing failed
WooCommerce Setup Instructions
1. Navigate to Sentinel → Event Registry
2. Locate '3rd Party Plugin Integrations' section
3. Click 'Setup WooCommerce Events' button
4. Events are automatically created and enabled
5. Control events directly in Plugin Integrations section
6. Monitor orders in Activity Log
Automatic Integration: Once WooCommerce events are set up, Sentinel automatically logs all order activities, payment transactions, and status changes without requiring any additional configuration.

Contact Form 7 Integration

Monitor your Contact Form 7 submissions with detailed tracking and failure analysis. This integration automatically detects Contact Form 7 and provides comprehensive form monitoring without any additional configuration.

Available in Sentinel Basic: Contact Form 7 integration is included in the basic version of Sentinel. No upgrade required to monitor your form activities.

Overview

Contact Form 7 Integration provides comprehensive monitoring of your contact form activities. Track successful submissions, identify failed submissions, and analyze user engagement with detailed event logging that captures form metadata and submission details.

Tracked Events

The Contact Form 7 integration automatically monitors the following events:

Form Submission Events

2 Events
cf7_form_submitted Form successfully submitted
cf7_form_failed Form submission failed

WPForms Integration

Monitor your WPForms submissions and payments with comprehensive tracking and analytics. This integration supports both WPForms Lite and WPForms Pro, automatically detecting the active version and providing appropriate monitoring.

Available in Sentinel Basic: WPForms integration is included in the basic version of Sentinel. No upgrade required to monitor your form activities.

Overview

WPForms Integration provides comprehensive monitoring of your WPForms activities. Track form submissions, payment completions, and user interactions with detailed event logging that captures form metadata, field information, and payment details.

Tracked Events

The WPForms integration automatically monitors the following events:

Form Submission Events

2 Events
wpf_form_submitted Form entry successfully saved
wpf_payment_completed Payment successfully processed

Gravity Forms Integration

Monitor your Gravity Forms submissions and payments with comprehensive tracking and analytics. This integration automatically detects Gravity Forms and provides detailed form monitoring capabilities.

Available in Sentinel Basic: Gravity Forms integration is included in the basic version of Sentinel. No upgrade required to monitor your form activities.

Overview

Gravity Forms Integration provides comprehensive monitoring of your Gravity Forms activities. Track form submissions, payment completions, and user interactions with detailed event logging that captures form metadata and submission details.

Tracked Events

The Gravity Forms integration automatically monitors the following events:

Form Submission Events

2 Events
gf_form_submitted Form successfully submitted
gf_payment_complete Payment successfully processed

Yoast SEO Integration

Monitor your SEO optimization activities with comprehensive tracking of meta changes, score improvements, schema updates, and bulk operations. Yoast SEO integration provides detailed insights into your content optimization workflow.

Available in Sentinel Basic: Yoast SEO integration is included in the basic version of Sentinel. No upgrade required to monitor your SEO activities.

Overview

Yoast SEO Integration provides comprehensive monitoring of your SEO optimization activities. Track meta field updates, SEO score changes, schema markup modifications, and bulk SEO operations with detailed event logging that captures specific field changes, score improvements, and optimization patterns.

SEO Event Tracking

The Yoast SEO integration automatically monitors the following SEO activities:

SEO Event Tracking

4 Events
yoast_meta_updated SEO title, meta description, or focus keyword updated
yoast_score_changed SEO or readability score improved or declined
yoast_schema_updated Structured data or schema type modified
yoast_bulk_action Bulk SEO optimization or bulk edit performed

Smart Detection Features

The Yoast SEO integration includes intelligent detection capabilities:

Field-Specific Tracking

Distinguishes between different SEO fields (title, description, focus keyword) and provides specific context for each change.

Score Change Detection

Monitors both SEO keyword scores and readability scores separately, tracking improvements and declines.

Bulk Operation Intelligence

Automatically detects bulk operations through pattern recognition and WordPress bulk edit integration.

Schema Type Recognition

Identifies specific schema field changes and provides context about structured data modifications.

Setup Instructions

Setting up Yoast SEO monitoring is automatic once both plugins are active:

1

Install Yoast SEO

Ensure Yoast SEO plugin is installed and activated on your WordPress site.

2

Enable Integration

Navigate to Sentinel → Event Registry and click "Setup Yoast SEO Events" in the integration templates section.

3

Customize Events

Configure which SEO events to monitor and set appropriate priority levels for your monitoring needs.

Setup & Configuration

Learn how to set up and configure third-party plugin integrations in Sentinel. This section covers the complete setup process, configuration options, and troubleshooting common issues.

Initial Setup

Setting up third-party plugin integrations is a straightforward process that requires minimal configuration:

1

Access Event Registry

Navigate to Sentinel → Event Registry in your WordPress admin dashboard.

2

Locate Plugin Integrations

Scroll down to the "3rd Party Plugin Integrations" section. Sentinel will automatically detect active plugins and show available setup templates.

3

Setup Plugin Events

Click the "Setup [Plugin Name] Events" button for each plugin you want to monitor. This creates and enables all relevant events automatically.

4

Verify Setup

Check the "Plugin-Specific Event Controls" section to see your newly created events. You can enable/disable individual events as needed.

File Monitoring

Monitor critical WordPress files for unauthorized changes with Sentinel's file integrity monitoring system. Detect potential security breaches by tracking modifications to important system files.

Available in Sentinel Basic: Core file monitoring with scheduling, exclusions, and alert thresholds. Sentinel+ adds custom files, theme/plugin monitoring, and real-time detection.

Overview

File monitoring tracks changes to critical WordPress files using MD5 hash verification. When files are modified, Sentinel logs the event with detailed information about the change.

Hash-based Detection
Flexible Scheduling
Smart File Exclusions
Alert Thresholds
Custom File Paths (Sentinel+)
Theme File Monitoring (Sentinel+)
Plugin File Monitoring (Sentinel+)
Real-time Monitoring (Sentinel+)

How It Works

Sentinel's file monitoring system works through a simple but effective process:

1

Initial Hash Creation

When file monitoring is enabled, Sentinel creates MD5 hashes of monitored files and stores them as baseline values.

2

Daily Verification

Every day, Sentinel recalculates the hashes of monitored files and compares them against the stored baseline values.

3

Change Detection

When a hash mismatch is detected, Sentinel logs the change event with file details and size changes.

4

Baseline Update

After logging the change, Sentinel updates the stored hash with the new file state for future comparisons.

Setup & Configuration

Configure file monitoring through the Sentinel settings page:

Enable File Monitoring
1. Navigate to Sentinel → Settings
2. Go to 'Privacy & Security' tab
3. Enable 'File Monitoring'
4. Configure monitoring frequency (hourly/daily/weekly)
5. Enable 'Exclude Log Files' (recommended)
6. Set alert threshold (default: 10 bytes)
7. Add custom exclusion patterns if needed
8. Set up theme/plugin monitoring (Sentinel+)
9. Save settings
Setting Description Default Sentinel+ Feature
Critical File Monitoring Monitor wp-config.php and .htaccess for changes Disabled No
Monitor Custom File Paths Monitor additional files beyond core WordPress files Disabled Yes
Monitor Active Theme Files Monitor functions.php and style.css of active theme Disabled Yes
Monitor Critical Plugin Files Monitor important plugin files for changes Disabled Yes
Real-time File Monitoring Immediate detection of file changes (resource intensive) Disabled Yes
Monitoring Frequency How often to check files (hourly, twice daily, daily, weekly) Daily No
Exclude Log Files Prevent monitoring of debug.log, error.log, etc. (prevents recursion) Enabled No
Custom Exclusion Patterns File patterns to exclude (*.log, *.tmp, *.cache) *.log, *.tmp, *.cache No
Alert Threshold Minimum file size change in bytes to trigger alerts 10 bytes No

Monitored Files

Sentinel monitors different types of files based on your configuration:

Core WordPress Files (Free)

2 Files
wp-config.php WordPress configuration file
.htaccess Server configuration file
Sentinel+ Features: Monitor custom file paths, active theme files (functions.php, style.css), critical plugin files, and enable real-time monitoring for immediate change detection.

Custom File Path Examples

Custom File Paths (Sentinel+)
# Theme files
wp-content/themes/your-theme/functions.php
wp-content/themes/your-theme/style.css

# Plugin files
wp-content/plugins/important-plugin/plugin.php

# Server configs
/etc/apache2/sites-available/your-site.conf
/var/www/html/.htaccess

# Custom files
wp-content/uploads/critical-config.json

Understanding Alerts

When file changes are detected, Sentinel logs detailed information about the modification:

📋 Alert Information Includes:

Each file monitoring alert provides comprehensive details to help you assess the significance and legitimacy of file changes:

  • File Identity: Complete file name and full system path
  • Change Summary: Detailed description (additions, deletions, modifications)
  • Size Impact: Exact bytes added or removed from the file
  • Timestamps: Previous and current modification times for comparison
  • File Classification: Automatic categorization (core, theme, plugin, custom)
  • Priority Assessment: Risk level based on file importance and location

💡 Pro Tip: Use the alert threshold setting to reduce noise from minor changes while keeping important modifications visible.

Event Details

Event Type Files Monitored Priority Description
file_modified All monitored files Critical File monitoring system detected unauthorized changes to critical files

Change Summary Examples

Sample Alert Messages
wp-config.php was modified (+156 bytes) - WordPress configuration file had moderate additions

.htaccess was modified (-23 bytes) - Server configuration file had minor deletions

custom-config.php was modified (same size - content changed) - Critical system file was modified (same size - content changed)

Best Practices

Follow these recommendations for effective file monitoring:

1

Enable Log File Exclusions

Always keep "Exclude Log Files" enabled to prevent recursive monitoring loops. This prevents debug.log from triggering continuous alerts.

2

Set Appropriate Alert Thresholds

Use the default 10-byte threshold to reduce noise from tiny file changes. Increase for high-traffic sites that frequently update files.

3

Choose the Right Monitoring Frequency

Daily monitoring is sufficient for most sites. Use hourly for critical production sites, weekly for development environments.

4

Use Custom Exclusions Wisely

Exclude cache files, temporary files, and frequently changing logs using patterns like *.cache, *.tmp, backup-*.zip.

5

Monitor Important Files Only

Focus on critical system files (wp-config.php, .htaccess). Use Sentinel+ for theme/plugin monitoring on development sites.

6

Use Real-time Monitoring Carefully

Real-time monitoring is resource intensive. Only enable it for critical files that rarely change and require immediate detection.

Troubleshooting

Common issues and solutions for file monitoring:

File monitoring not working

Possible causes:

  • File monitoring is disabled in settings
  • Files don't exist or aren't readable
  • Custom file paths are invalid or outside allowed directories

Solution: Check Sentinel settings in Privacy & Security tab, verify file paths exist and are readable by WordPress.

Too many false positives

Possible causes:

  • Alert threshold set too low (detecting tiny changes)
  • Log files are being monitored (causing recursion)
  • Cache or temporary files being monitored

Solution: Increase alert threshold to 50+ bytes, enable "Exclude Log Files", add patterns like *.cache, *.tmp to custom exclusions.

Debug log recursion (continuous alerts)

Possible causes:

  • "Exclude Log Files" is disabled
  • debug.log is in custom file paths
  • Custom exclusion patterns not working

Solution: Enable "Exclude Log Files" setting, remove debug.log from custom paths, add *.log to exclusion patterns.

Theme/Plugin monitoring not working (Sentinel+)

Possible causes:

  • Features disabled in settings
  • Theme/plugin files don't exist
  • License not active

Solution: Verify Sentinel+ license is active, enable theme/plugin monitoring in settings, check that theme files exist.

Custom file paths not working

Possible causes:

  • Invalid path format
  • Security restrictions
  • Files outside allowed directories

Solution: Use relative paths from WordPress root or absolute paths within allowed directories. Check debug logs for validation errors.

Debug Information: Enable WordPress debug logging to see detailed file monitoring information. Check your debug.log for entries starting with "[Sentinel] File Monitor:".

Enhanced Diff Viewer (Sentinel+)

Sentinel+ includes an advanced diff viewer that shows exactly what changed in your files - similar to GitHub's diff view. This premium feature goes beyond basic hash detection to provide detailed line-by-line comparisons.

Sentinel+ Feature: The enhanced diff viewer requires a premium license. Free users still receive file change notifications with hash verification, but only premium users can see the detailed changes.

How It Works

When a file is modified, Sentinel+ automatically:

  1. Creates baseline: Stores the original file content when first detected
  2. Generates diff: Compares current content with stored baseline
  3. Stores history: Maintains up to 10 recent changes per file
  4. Shows changes: Displays unified diff format with syntax highlighting

Using the Diff Viewer

The diff viewer appears in both the dashboard activity feed and the full logs view:

1
Locate File Change

Look for "File Modified" events in your activity logs. Premium users will see both "View Details" and "View Changes" buttons.

2
Open Diff Viewer

Click the "View Changes" button (code icon) to open the diff viewer. The viewer loads dynamically without refreshing the page.

3
Review Changes

The diff viewer shows:

  • + Green lines: Added content
  • - Red lines: Removed content
  • Gray lines: Unchanged context
  • Blue headers: File information and line numbers

Best Practices

  • Regular Reviews: Check file changes weekly, especially on production sites
  • Investigate Unknowns: Any unexpected changes should be investigated immediately
  • Document Changes: Keep notes about legitimate changes for future reference
  • Monitor Critical Files: Pay special attention to wp-config.php, .htaccess, and theme files
  • Backup Before Changes: Use the diff viewer to verify changes before accepting them

Alerts & Notifications

Configure email alerts and notifications to stay informed about critical security events on your WordPress site.

Notification Types

Sentinel offers three types of notifications:

  • Real-time Alerts: Instant email notifications for critical security events
  • Daily Digests: Comprehensive daily summaries of site activity and errors
  • Weekly Reports: Detailed analytics including health reports and security trends

Setting Up Real-time Alerts

Configure instant notifications for critical events. Navigate to Sentinel → Settings → Notifications to access these settings.

Required: You must first enable "Email Notifications" to activate any alert functionality.

Alert Types & Triggers

Choose which events trigger immediate notifications:

Alert Type Trigger Condition Examples Recommended
Critical Events Fires when priority = critical Failed admin logins, plugin vulnerabilities, file modifications ✓ Essential
Security Events Fires when category = security Brute force attempts, suspicious IP activity, permission changes ✓ Essential
High-priority Events Fires when priority = high User role changes, plugin installations, theme modifications ⚠ Use carefully

Fine-tuning Options

Additional filters to control when alerts are sent:

  • Category Filters: Select specific event categories (Authentication, Content, System, Error, Security)
  • Priority Filters: Choose priority levels (High, Medium, Low)
  • Per-event Control: Disable individual events in Sentinel → Event Registry (affects both logging and alerts)
Evaluation Order: Sentinel checks real-time toggles first, then category toggles, then priority toggles. If any condition matches, an email is sent immediately.

Email Recipients

Configure who receives alert notifications in Sentinel → Settings → Notifications.

Notification Email
Single Address

Set a specific email address for notifications. Uses sanitize_email() validation and wp_mail() for delivery.

Fallback: If left empty, notifications fall back to the site's Admin Email address.

Daily Digest Reports

Aggregated reports sent daily at ~9:00 AM site time via WP-Cron:

Event Summary

daily_summary
totals Event totals and active users
breakdown Category/priority breakdown

Error Report

daily_error
error_count Total error count
recent_errors Recent error details

User Activity

daily_user
active_users Top active users
recent_events Most recent user events

Weekly Digest Reports

Comprehensive weekly reports sent on Mondays at ~9:00 AM site time:

Health Report

weekly_health
uptime Uptime estimate
event_counts Critical/high/medium counts

Performance Metrics

weekly_performance
response_time Average response time
memory_peak Peak memory usage

Security Summary

weekly_security
security_totals Security event totals
failed_logins Failed login attempts
WP-Cron Dependency: Both daily and weekly digests rely on WP-Cron. Ensure your host supports WP-Cron or implement alternative cron solutions for reliable delivery.

Recommended Starter Configuration

Production-ready configuration for development and production environments:

Category Recommended Settings Reasoning
Real-time Enable Critical and Security Catches the most important events without noise
Daily Digest Enable Error Report and User Activity Daily overview of problems and user behavior
Weekly Digest Enable Health and Security Weekly health check and security trends
Optional Add Performance if needed Only if you care about timing/memory metrics
Production Tip: This configuration balances security monitoring with operational efficiency. Adjust based on your site's traffic patterns, security requirements, and team size.

Export & Import

Transfer your logs and move your chosen configuration between Sentinel installations with ease.

Data Export

Pull activity records into different formats for review, reporting or regulatory compliance. Whether you're analysing patterns or preparing audits, there's a format to suit your needs.

Supported Formats

  • CSV: Great for spreadsheet programs such as Excel or Google Sheets
  • JSON: Ideal when connecting to external systems or APIs
  • XML: Provides compatibility with older or legacy applications

User Management

Sentinel lets you decide who can see the logs, download data or change settings. Assign abilities based on the role each user plays:

Role-Based Permissions

Control access to Sentinel features based on user roles:

Role View Logs Export Data Modify Settings
Administrator
Editor
Author
Access Control: This keeps sensitive log data and configuration changes under the control of those who need it, while still allowing other users access to view-only functions.

Hooks & Filters

Sentinel provides several action hooks that allow developers to extend and integrate with its monitoring system. These hooks fire at key moments in the event lifecycle, enabling you to build custom integrations, notifications, and automation workflows.

Available Hooks: Sentinel currently provides 3 main action hooks for developers to extend functionality. These hooks allow you to respond to events being logged, security incidents, and event registrations.

Available Action Hooks

These are the actual hooks provided by Sentinel that you can use to extend functionality.

sentinel_event_logged
// Triggered after any event is successfully logged
// Parameters: $event_key (string), $event_data (array), $user_id (int)
add_action('sentinel_event_logged', 'my_event_handler', 10, 3);

function my_event_handler($event_key, $event_data, $user_id) {
    // Send critical security events to Slack
    $critical_events = ['failed_login_attempt', 'user_role_changed', 'plugin_activated'];
    if (in_array($event_key, $critical_events)) {
        $user = get_user_by('ID', $user_id);
        $username = $user ? $user->display_name : 'System';

        wp_remote_post('https://hooks.slack.com/your-webhook-url', [
            'body' => json_encode([
                'text' => sprintf('🚨 Security Event: %s by %s', $event_key, $username),
                'attachments' => [
                    [
                        'color' => 'danger',
                        'fields' => [
                            ['title' => 'Event', 'value' => $event_key, 'short' => true],
                            ['title' => 'User', 'value' => $username, 'short' => true],
                            ['title' => 'Data', 'value' => json_encode($event_data, JSON_PRETTY_PRINT)]
                        ]
                    ]
                ]
            ])
        ]);
    }

    // Log high-priority events to external monitoring service
    $priority_events = ['maintenance_mode_enabled', 'security_incident_opened', 'core_file_modified'];
    if (in_array($event_key, $priority_events)) {
        wp_remote_post('https://monitoring-service.com/api/events', [
            'headers' => [
                'Content-Type' => 'application/json',
                'Authorization' => 'Bearer ' . get_option('monitoring_api_key')
            ],
            'body' => json_encode([
                'source' => 'WordPress-Sentinel',
                'site' => get_site_url(),
                'event_type' => $event_key,
                'user_id' => $user_id,
                'data' => $event_data,
                'timestamp' => current_time('mysql')
            ])
        ]);
    }
}
sentinel_event_registered
// Triggered when a new event type is registered with Sentinel
// Parameters: $event_key (string), $config (array)
add_action('sentinel_event_registered', 'handle_new_event_registration', 10, 2);

function handle_new_event_registration($event_key, $config) {
    // Log when new custom events are registered
    error_log(sprintf(
        'New Sentinel event registered: %s (Category: %s, Priority: %s)',
        $event_key,
        $config['category'] ?? 'unknown',
        $config['priority'] ?? 'medium'
    ));

    // Automatically enable high-priority security events
    if (isset($config['category']) && $config['category'] === 'security') {
        if (isset($config['priority']) && in_array($config['priority'], ['high', 'critical'])) {
            // Ensure this security event is not disabled
            $disabled_events = get_option('sentinel_disabled_events', []);
            if (in_array($event_key, $disabled_events)) {
                $disabled_events = array_diff($disabled_events, [$event_key]);
                update_option('sentinel_disabled_events', $disabled_events);
            }
        }
    }

    // Notify administrators about new business-critical events
    if (isset($config['category']) && $config['category'] === 'business') {
        $admin_email = get_option('admin_email');
        wp_mail(
            $admin_email,
            'New Business Event Registered in Sentinel',
            sprintf(
                'A new business event has been registered: %s\n\nDescription: %s\n\nThis event is now being monitored.',
                $event_key,
                $config['description'] ?? 'No description provided'
            )
        );
    }
}
sentinel_security_incident_notification
// Triggered when a security incident notification is sent
// Parameters: $notification_data (array) containing incident details
add_action('sentinel_security_incident_notification', 'handle_security_incidents', 10, 1);

function handle_security_incidents($notification_data) {
    $incident_id = $notification_data['incident_id'] ?? 'unknown';
    $event = $notification_data['event'] ?? [];

    // Send immediate SMS alert for critical security incidents
    if (isset($event['priority']) && $event['priority'] === 'critical') {
        // Using a service like Twilio
        wp_remote_post('https://api.twilio.com/2010-04-01/Accounts/YOUR_ACCOUNT_SID/Messages.json', [
            'headers' => [
                'Authorization' => 'Basic ' . base64_encode('YOUR_ACCOUNT_SID:YOUR_AUTH_TOKEN')
            ],
            'body' => [
                'From' => '+1234567890',
                'To' => '+1987654321',
                'Body' => sprintf(
                    'CRITICAL SECURITY ALERT: Incident #%s detected on %s. Event: %s',
                    $incident_id,
                    get_site_url(),
                    $event['event_key'] ?? 'Unknown'
                )
            ]
        ]);
    }

    // Log to external security information and event management (SIEM) system
    wp_remote_post('https://your-siem-system.com/api/incidents', [
        'headers' => [
            'Content-Type' => 'application/json',
            'X-API-Key' => get_option('siem_api_key')
        ],
        'body' => json_encode([
            'source' => 'WordPress-Sentinel',
            'incident_id' => $incident_id,
            'site' => get_site_url(),
            'severity' => $event['priority'] ?? 'medium',
            'event_details' => $event,
            'timestamp' => current_time('c')
        ])
    ]);

    // Create ticket in support system for high-priority incidents
    if (in_array($event['priority'] ?? 'medium', ['high', 'critical'])) {
        wp_remote_post('https://support-system.com/api/tickets', [
            'headers' => [
                'Authorization' => 'Bearer ' . get_option('support_api_token'),
                'Content-Type' => 'application/json'
            ],
            'body' => json_encode([
                'title' => sprintf('Security Incident #%s - %s', $incident_id, $event['event_key'] ?? 'Unknown'),
                'description' => sprintf(
                    'Security incident detected by Sentinel monitoring system.\n\nIncident ID: %s\nSite: %s\nEvent: %s\nPriority: %s\n\nDetails: %s',
                    $incident_id,
                    get_site_url(),
                    $event['event_key'] ?? 'Unknown',
                    $event['priority'] ?? 'medium',
                    json_encode($event, JSON_PRETTY_PRINT)
                ),
                'priority' => $event['priority'] ?? 'medium',
                'category' => 'security'
            ])
        ]);
    }
}

Filter Hooks

Currently, Sentinel does not provide any filter hooks for modifying data or behavior. All extension points are provided through action hooks shown above.

Future Development: Filter hooks for data modification and behavior customization may be added in future versions based on developer feedback and requirements.

Functions

Useful functions for working with Sentinel programmatically.

Core Functions

Essential functions for integrating with Sentinel.

Logging Functions
// Log an event

sentinel_log_event($event_type, $message, $user_id = null, $metadata = []);



// Get recent events

$events = sentinel_get_recent_events($limit = 10);



// Check if event type is enabled

$enabled = sentinel_is_event_enabled($event_type);

Classes

Object-oriented approach to working with Sentinel.

Main Classes

Core classes for advanced integration.

Sentinel_Logger Class
// Initialize logger

$logger = new Sentinel_Logger();



// Log an event

$logger->log($event_type, $message, $user_id, $metadata);



// Get events with filters

$events = $logger->get_events([

    'user_id' => 1,

    'event_type' => 'login',

    'date_from' => '2024-01-01'

]);

Premium Activation

Unlock the full power of Sentinel with Sentinel+ premium features. This guide walks you through purchasing, activating, and verifying your premium license.

Overview

Sentinel+ includes advanced features that enhance your WordPress security monitoring capabilities:

Custom Events

Create and monitor custom security events tailored to your specific needs.

Advanced Monitoring

Enhanced detection algorithms and real-time threat analysis.

Priority Support

Get faster response times and dedicated support for premium users.

Enhanced Reporting

Detailed analytics, custom reports, and advanced data visualization.

Purchase Process

Getting Sentinel+ is quick and easy:

1

Visit the Purchase Page

Click the purchase button below to start your subscription.

Buy Sentinel+ - £9/month
2

Complete Payment

Secure payment processing via Stripe. You'll receive a confirmation email with your license key.

3

Activate Your License

Follow the activation steps below to unlock premium features on your WordPress site.

License Activation

Activate your Sentinel+ license to unlock premium features:

Activation Steps
// 1. Navigate to Sentinel Settings in WordPress Admin

// Go to: WordPress Admin → Sentinel → Settings

// 2. Enter your license key in the License Key field

// Format: SEN-XXXX-XXXX-XXXX-XXXX

// 3. Click "Activate License"

// 4. Verify activation status shows "Active"
Lost your license key? Use our License Recovery System to get it sent to your email instantly.

Verification

Confirm your Sentinel+ activation is working correctly:

License status shows "Active" in Sentinel Settings
Custom Events section appears in Sentinel admin
Premium features are accessible and functional
No activation errors in WordPress admin notices

Troubleshooting

Common issues and solutions for Sentinel+ activation:

License Key Not Working

Problem: License key is rejected or shows as invalid.

Solution: Verify the key format (SEN-XXXX-XXXX-XXXX-XXXX) and ensure no extra spaces or characters. If still having issues, use our License Recovery System.

Features Not Appearing

Problem: Premium features don't show up after activation.

Solution: Clear any caching plugins, refresh the WordPress admin page, and check that your license status shows "Active".

Domain Locking Issues

Problem: License is locked to wrong domain or can't activate on new site.

Solution: Contact support to unlock your domain or reset activations if you've moved your site.

Still having issues? Contact our support team through the contact page for personalized assistance with your Sentinel+ activation.

REST API

Access Sentinel data programmatically via REST API endpoints. The API provides read-only access to activity logs, statistics, and event configuration data for external integrations and monitoring tools.

Setup Required: REST API access must be enabled in Sentinel → Settings → Log Management → API Access before endpoints become available.

API Configuration

Enable and configure REST API access through the WordPress admin interface.

1

Enable API Access

Navigate to Sentinel → Settings → Log Management and check "Enable REST API access"

2

Test API Access

Verify endpoints are available at /wp-json/sentinel-plugin/v1/

No Authentication Required: Current implementation allows public access when API is enabled. In production environments, consider implementing additional authentication layers for security.

API Key Authentication

Sentinel provides secure API key authentication for REST API access. Generate API keys through the WordPress admin to provide token-based access without requiring WordPress user accounts.

New in v1.1.0: API key authentication is now available as a free feature for both Sentinel and Sentinel+ users.

Generating API Keys

1

Navigate to Settings

Go to Sentinel → Settings in your WordPress admin

2

Find API Key Section

Locate the "API Key" section below the License Key field

3

Generate Key

Click "Generate Key" to create a new API key, or "Regenerate" to replace an existing one

Authentication Methods

Include your API key in requests using either method:

HTTP Header (Recommended)
curl -H "X-Sentinel-API-Key: YOUR_API_KEY_HERE" \ "https://yoursite.com/wp-json/sentinel-plugin/v1/logs"
URL Parameter (Alternative)
https://yoursite.com/wp-json/sentinel-plugin/v1/logs?api_key=YOUR_API_KEY_HERE
Security Note: HTTP headers are more secure than URL parameters, which may be logged by web servers.

JavaScript Example

Fetch API Authentication
fetch('https://yoursite.com/wp-json/sentinel-plugin/v1/logs', { headers: { 'X-Sentinel-API-Key': 'YOUR_API_KEY_HERE' } }) .then(response => response.json()) .then(data => console.log('Logs:', data.logs));

Base URL & Namespace

All API endpoints use the following base structure:

API Base URL
https://yoursite.com/wp-json/sentinel-plugin/v1/

API Namespace: sentinel-plugin/v1

Response Format: JSON

Available Endpoints

The following REST API endpoints are currently available:

Endpoint Method Description
/logs GET Retrieve activity logs with filtering and pagination
/stats GET Get activity statistics and summary data
/events/types GET List all registered event types and configurations

GET /logs

Retrieve activity logs with optional filtering and pagination support.

Basic Request
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/logs'

Query Parameters:

  • limit (integer) - Number of logs to return. Default: 50, Max: 1000
  • offset (integer) - Number of logs to skip. Default: 0
  • event_key (string) - Filter by specific event type
  • priority (string) - Filter by priority level (low, medium, high, critical)
  • user_id (integer) - Filter by specific user ID
Filtered Request Example
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/logs?event_key=user_login&limit=25&priority=high'
Response Format
{
  "logs": [
    {
      "id": 123,
      "event_key": "user_login",
      "category": "authentication",
      "priority": "medium",
      "user_id": 1,
      "ip_address": "192.168.1.100",
      "url": "/wp-admin/",
      "data": {
        "username": "admin",
        "success": true
      },
      "created_at": "2024-01-15 10:30:45",
      "user": {
        "username": "admin",
        "display_name": "Administrator"
      }
    }
  ],
  "pagination": {
    "total": 1250,
    "limit": 50,
    "offset": 0,
    "pages": 25
  }
}

GET /stats

Retrieve summary statistics and activity breakdowns.

Request
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/stats'
Response Format
{
  "summary": {
    "total_logs": 5420,
    "today_logs": 127,
    "active_users_today": 8
  },
  "categories": [
    {
      "name": "authentication",
      "count": 1245
    },
    {
      "name": "content",
      "count": 892
    }
  ],
  "priorities": [
    {
      "name": "medium",
      "count": 3210
    },
    {
      "name": "low",
      "count": 1890
    }
  ]
}

GET /events/types

List all registered event types with their configuration details.

Request
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/events/types'
Response Format
{
  "event_types": [
    {
      "key": "user_login",
      "label": "User Login",
      "category": "authentication",
      "priority": "medium",
      "description": "User successfully logs into the system"
    },
    {
      "key": "woo_new_order",
      "label": "WooCommerce New Order",
      "category": "ecommerce",
      "priority": "high",
      "description": "New order placed by customer"
    }
  ],
  "total": 24
}

Error Responses

Standard HTTP error responses and error codes.

HTTP Code Error Code Description
400 rest_invalid_param Invalid parameter values (e.g., limit out of range)
403 rest_forbidden API access disabled in settings
500 rest_internal_error Server error or database issues
Error Response Format
{
  "code": "rest_forbidden",
  "message": "API access is disabled.",
  "data": {
    "status": 403
  }
}

Integration Examples

Real-world examples of integrating with the Sentinel REST API.

JavaScript/Node.js Example
// Monitor login failures in real-time
const fetch = require('node-fetch');

async function checkLoginFailures() {
  try {
    const response = await fetch('https://yoursite.com/wp-json/sentinel-plugin/v1/logs?event_key=failed_login&limit=10');
    const data = await response.json();

    if (data.logs.length > 0) {
      console.log(`${data.logs.length} recent login failures detected`);

      data.logs.forEach(log => {
        console.log(`Failed login from ${log.ip_address} at ${log.created_at}`);
      });
    }
  } catch (error) {
    console.error('API request failed:', error);
  }
}

// Check every 5 minutes
setInterval(checkLoginFailures, 5 * 60 * 1000);
PHP Example
<?php
// External monitoring script
function my_site_activity_summary($site_url) {
    $api_url = rtrim($site_url, '/') . '/wp-json/sentinel-plugin/v1/stats';

    $response = wp_remote_get($api_url);

    if (is_wp_error($response)) {
        error_log('Sentinel API error: ' . $response->get_error_message());
        return false;
    }

    $data = json_decode(wp_remote_retrieve_body($response), true);

    if (isset($data['summary'])) {
        return [
            'total_logs' => $data['summary']['total_logs'],
            'today_activity' => $data['summary']['today_logs'],
            'active_users' => $data['summary']['active_users_today']
        ];
    }

    return false;
}

// Usage
$summary = my_site_activity_summary('https://yoursite.com');
if ($summary) {
    echo 'Today: ' . $summary['today_activity'] . ' activities by ' . $summary['active_users'] . ' users';
}
?>
Python Example
import requests
import json

class SentinelAPI:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip('/') + '/wp-json/sentinel-plugin/v1'

    def get_logs(self, **filters):
        '''Get activity logs with optional filters'''
        response = requests.get(f'{self.base_url}/logs', params=filters)
        response.raise_for_status()
        return response.json()

    def get_stats(self):
        '''Get activity statistics'''
        response = requests.get(f'{self.base_url}/stats')
        response.raise_for_status()
        return response.json()

    def get_security_events(self, limit=50):
        '''Get security-related events'''
        return self.get_logs(
            event_key='failed_login,suspicious_activity',
            priority='high,critical',
            limit=limit
        )

# Usage
api = SentinelAPI('https://yoursite.com')

# Get today's failed logins
failed_logins = api.get_logs(event_key='failed_login', limit=10)
print(f'Recent failed logins: {len(failed_logins["logs"])}')

# Get site statistics
stats = api.get_stats()
print(f'Total logs: {stats["summary"]["total_logs"]}')

Rate Limiting & Best Practices

Guidelines for responsible API usage and performance optimization.

Current Implementation: No rate limiting is currently implemented. Consider implementing caching and reasonable request intervals in your applications.

Recommended Practices:

  • Pagination: Use limit and offset parameters for large datasets
  • Filtering: Apply specific filters to reduce response sizes
  • Caching: Cache responses locally when appropriate
  • Error Handling: Implement proper error handling and retry logic
  • Monitoring: Monitor your API usage to avoid overwhelming the server

Common Issues

Solutions to frequently encountered problems.

Troubleshooting FAQs

Common issues and their solutions.

Why are some events not being logged?

Check SentinelEvent Registry to ensure the event type isn’t disabled. Also make sure your role isn’t excluded in SettingsPrivacy & Security. If batch logging is on, a stuck queue (sentinel_log_queue) can delay logging until processed.

I enabled “Error events” alerts but I never get them. Why?

In v1.0.0, the “Error events” real-time toggle checks for priority = error, but no events have this priority. Use the Error category toggle instead until fixed in the next release.

Can I send email alerts to multiple addresses?

Not in v1.0.0. Only the first valid email entered in SettingsNotifications is used. To send to more people, use a group/distribution Notifications is used. To send to more people, use a group/distribution email address.

Frequently Asked Questions

Common questions and answers about Sentinel to help you get the most out of your security monitoring.

Does Sentinel slow down my website?

No! Sentinel is designed for minimal performance impact. It uses efficient batch logging, asynchronous processing, and includes performance optimization settings to ensure your site runs smoothly. The plugin typically adds less than 50ms to page load times.

Can I export my activity logs?

Yes! Sentinel includes CSV export functionality for compliance reporting and data analysis. You can export logs by date range, event type, or user. Perfect for security audits, compliance requirements, and long-term record keeping.

Is Sentinel GDPR compliant?

Sentinel provides tools (IP anonymization, data export/deletion, role-based access, audit logs) to help you comply with GDPR, but compliance depends on how you configure and use it. We recommend consulting with legal professionals for full compliance.

How much storage space do the logs use?

Log storage depends on your site's activity level. A typical site with moderate traffic uses approximately 1-5MB per month. Sentinel includes automatic cleanup features to manage storage efficiently, and you can adjust retention periods based on your needs.

Can Sentinel send me email alerts?

Yes. You can configure real-time alerts and daily/weekly digests in Settings → Notifications. In v1.0.0, only one recipient email is supported.

How do I stop logging for certain users or roles?

Use Settings → Privacy & Security to exclude specific user roles from logging. This is useful for developers or staging site admins.

What happens when database logging fails?

Sentinel uses a queue-based retry system to ensure no important events are lost:

  • Automatic Queuing: Failed logs are stored in WordPress transients for retry
  • Smart Retry: Automatic retry on every admin page load with up to 3 attempts per log
  • Manual Retry: "🔄 Retry Failed Logs" button in settings for immediate retry
  • No Data Loss: Logs are preserved for 24 hours with automatic cleanup
  • Debug Information: Detailed logging shows retry attempts and results

Check the ⚠️ Queued Failed Logs section in Sentinel Settings to see any pending retries.

Can I monitor multiple WordPress sites?

Sentinel is installed per site. To monitor multiple sites, install it on each one. Centralized dashboards could be built using exports or third-party integrations.

Support

Get help when you need it most.

Direct Support

Priority

Get personalized help from our team. Include your WordPress version, Sentinel version, and specific error messages.

Contact Support →

Latest Updates

v1.0.0

Download the newest version with bug fixes and feature improvements. Always backup before updating.

Download Latest →

Quick Diagnostics

Self-Help

Check your site's status: Go to Sentinel → Dashboard to see recent events, system health, and configuration warnings.

Emergency Issues

If Sentinel is causing site problems, deactivate the plugin immediately via Plugins → Installed Plugins and then contact support with details.

Custom Events

Extend Sentinel's monitoring capabilities beyond WordPress core events by creating and managing your own custom events for specific business logic, third-party plugins, and ecommerce activities.

Sentinel+ Feature: Custom Events is available in Sentinel+. It allows you to monitor business-specific activities, ecommerce transactions, and third-party plugin interactions beyond WordPress core events.

Overview

Custom Events bridge the gap between WordPress core monitoring and your specific business needs. While 3rd Party Plugin Integrations handle popular plugins like WooCommerce automatically, Custom Events let you create monitoring for unique business logic, specialized workflows, and unsupported plugins.

Note: This is separate from 3rd Party Plugin Integrations. Use Custom Events for business-specific monitoring that isn't covered by the built-in plugin integrations available to all users.

Creating Custom Events

For unique business requirements or unsupported plugins, create custom events manually through the admin interface.

1

Access Custom Events

Navigate to Sentinel → Event Registry in your WordPress admin. The Custom Events section appears at the top for Sentinel+ users.

2

Add New Event

Use the "Add New Custom Event" form to create events with unique keys, descriptive labels, categories, and appropriate priority levels.

3

Trigger Events

Use sentinel_log_event() in your code to trigger custom events with relevant data and context.

Basic Event Logging
// Log a custom event
sentinel_log_event('newsletter_signup', [
    'email' => $user_email,
    'source' => 'homepage_widget',
    'user_id' => get_current_user_id()
]);

// Log with custom user context
sentinel_log_event('form_abandoned', [
    'form_id' => $form_id,
    'completion_percentage' => 75,
    'time_spent' => 120
], $user_id);
Event Key Requirements: Event keys must be unique, contain only lowercase letters, numbers, and underscores. They cannot be changed after creation, so choose carefully.

Developer Hooks & Filters

Extend custom event functionality with WordPress hooks and filters.

sentinel_event_logged
// Hook into when events are logged
add_action('sentinel_event_logged', 'my_custom_event_handler', 10, 3);

function my_custom_event_handler($event_key, $event_data, $user_id) {
    // Custom logic when any event is logged
    if ($event_key === 'user_login') {
        // Do something special for login events
        update_user_meta($user_id, 'last_login_tracked', current_time('mysql'));
    }
}

Parameters:

  • $event_key (string) - The event key that was logged
  • $event_data (array) - Additional data associated with the event
  • $user_id (int) - ID of the user who triggered the event
sentinel_event_registered
// Hook into event registration
add_action('sentinel_event_registered', 'my_event_registration_handler', 10, 2);

function my_event_registration_handler($event_key, $config) {
    // React to new events being registered
    if ($config['category'] === 'security') {
        // Enable special monitoring for security events
        update_option('my_security_monitoring_' . $event_key, true);
    }
}

Parameters:

  • $event_key (string) - The event key being registered
  • $config (array) - Configuration array for the event

Advanced Functions

Programmatic functions for custom event management and integration.

sentinel_register_event()
// Register a basic custom event
sentinel_register_event('newsletter_signup', [
    'category' => 'marketing',
    'priority' => 'medium',
    'description' => 'User signed up for newsletter'
]);

// Register a security event
sentinel_register_event('suspicious_activity', [
    'category' => 'security',
    'priority' => 'high',
    'description' => 'Suspicious user behavior detected',
    'data_fields' => ['ip_address', 'user_agent', 'risk_score']
]);

// Register an ecommerce event
sentinel_register_event('cart_abandoned', [
    'category' => 'ecommerce',
    'priority' => 'low',
    'description' => 'Shopping cart was abandoned',
    'data_fields' => ['cart_value', 'items_count', 'user_id']
]);

Configuration Options:

  • category (string) - Event category: authentication, content, system, security, user, admin, general, audit
  • priority (string) - Priority level: low, medium, high, critical
  • description (string) - Human-readable description
  • data_fields (array) - Expected data field names
  • enabled (bool) - Whether event is enabled. Default: true

Plugin & Theme Integration

Real-world examples of integrating custom events into your plugins and themes.

Plugin Integration Example
// In your plugin's main file
class My_Plugin {

    public function __construct() {
        // Register custom events on plugin activation
        register_activation_hook(__FILE__, [$this, 'setup_sentinel_events']);

        // Hook into your plugin's key actions
        add_action('my_plugin_user_action', [$this, 'log_user_action']);
        add_action('my_plugin_error', [$this, 'log_plugin_error']);
    }

    public function setup_sentinel_events() {
        if (!function_exists('sentinel_register_event')) {
            return; // Sentinel not available
        }

        // Register plugin-specific events
        sentinel_register_event('my_plugin_action', [
            'category' => 'user',
            'priority' => 'medium',
            'description' => 'User performed action in My Plugin'
        ]);

        sentinel_register_event('my_plugin_error', [
            'category' => 'system',
            'priority' => 'high',
            'description' => 'Error occurred in My Plugin'
        ]);
    }

    public function log_user_action($action_data) {
        if (function_exists('sentinel_log_event')) {
            sentinel_log_event('my_plugin_action', $action_data);
        }
    }

    public function log_plugin_error($error) {
        if (function_exists('sentinel_log_event')) {
            sentinel_log_event('my_plugin_error', [
                'error_message' => $error->get_error_message(),
                'error_code' => $error->get_error_code()
            ]);
        }
    }
}
Theme Integration Example
// In your theme's functions.php
function my_theme_init() {
    // Register theme-specific events
    if (function_exists('sentinel_register_event')) {
        sentinel_register_event('theme_customizer_changed', [
            'category' => 'content',
            'priority' => 'low',
            'description' => 'Theme customizer settings modified'
        ]);
    }
}
add_action('init', 'my_theme_init');

// Log theme-specific events
function log_customizer_change($setting, $value) {
    if (function_exists('sentinel_log_event')) {
        sentinel_log_event('theme_customizer_changed', [
            'setting' => $setting,
            'new_value' => $value,
            'changed_by' => get_current_user_id()
        ]);
    }
}

// Hook into WordPress customizer
add_action('customize_save_after', function($customizer) {
    log_customizer_change('theme_options', 'bulk_update');
});