Installation
Get Sentinel up and running on your WordPress site in minutes with our comprehensive security monitoring solution.
System Requirements
Before installing Sentinel, ensure your WordPress site meets these requirements:
- WordPress: Version 5.0 or higher
- PHP: Version 7.4 or higher
- MySQL: Version 5.6 or higher
- Memory: Minimum 64MB PHP memory limit
Method 1: WordPress Repository (Coming Soon)
Once approved on WordPress.org, you'll be able to install directly from your admin dashboard.
Navigate to Plugins → Add New → Search for 'Sentinel' → Install & Activate
Method 2: Manual Installation
Download and install the plugin manually for immediate access.
- Download the plugin ZIP file from our download page
- Go to Plugins → Add New → Upload Plugin
- Choose the downloaded file and click Install Now
- Activate the plugin after installation
Post-Installation Checklist
After installing Sentinel, complete these essential steps:
Verify Installation
Check that "Sentinel" appears in your WordPress admin sidebar
Review Default Settings
Visit Sentinel → Settings to review and customize default configurations
Test Monitoring
Perform some actions on your site to verify events are being logged
Quick Setup
Configure Sentinel in under 5 minutes with these essential steps to start monitoring your WordPress site immediately.
1. Access the Dashboard
After activation, navigate to Sentinel in your WordPress admin sidebar. You'll see a comprehensive dashboard with real-time activity monitoring.
2. Review Event Settings
Visit Sentinel → Event Registry to customize which events to track. This is where you can enable or disable specific monitoring features based on your security needs.
• User logins/logouts
• Content creation/editing
• Plugin/theme changes
• Failed login attempts
• Admin actions
• File modifications
• Database changes
• Security events
3. Configure Alerts
Set up email notifications for critical security events. Go to Sentinel → Settings → Notifications Tab → Compliance & Monitoring to have sentinel send you an email when a critical security event occurs.
4. Test the System
Perform some test actions on your site to verify that Sentinel is properly logging events:
- Log out and log back in
- Create or edit a post
- Change a setting in your admin panel
- Check the activity log to see these events recorded
First Steps
Essential actions to take after installing Sentinel to maximize your security monitoring effectiveness.
Review Activity Log
Check Sentinel → Activity Log to see real-time monitoring data. This gives you immediate visibility into all user activities on your site.
Tailor Your Monitoring
Visit Sentinel → Event Registry to customize which events to track. This is where you can enable or disable specific monitoring features based on your security needs.
Optimize Performance
Adjust log retention and cleanup settings in Sentinel → Settings → Log Management. Set appropriate retention periods based on your compliance requirements.
Set Up User Permissions
Configure which user roles can access Sentinel features in Sentinel → Settings → Privacy & Security Tab → Access Control & Security. Restrict access to administrators and trusted editors only.
Enable Privacy Features
Configure GDPR compliance features in Sentinel → Settings → Privacy & Security Tab. Enable IP anonymization and data export capabilities.
Pro Tips for New Users
General Settings
Configure Sentinel's core functionality and behavior to match your security monitoring requirements.
Basic Configuration
Access general settings via Sentinel → Settings → Log Management Tab → Log Management & Retention. These settings control the fundamental behavior of the monitoring system.
| Setting | Description | Default | Recommended |
|---|---|---|---|
Auto-Cleanup |
When enabled, old logs will be automatically moved to archive or deleted based on the settings below. | Enabled | Enabled |
Age Limit |
Archive logs older than this many days. (Minimum: 1 day, Maximum: 10 years) | 90 days | 90 days |
Entry Limit |
Archive logs when total entries exceed this number. (Minimum: 100, Maximum: 1,000,000)r | 10000 | 10000 |
Cleanup Schedule |
How often to check for logs that need cleanup. | Daily | Daily |
Archive Retention |
How long to keep archived logs before permanent deletion. | 1 year | 1 year |
Database Optimization |
Optimize database tables to maintain performance and reduce storage space. | Enabled | Enabled |
Optimization Schedule |
How often to run database optimization. | Weekly | Weekly |
Advanced Configuration Options
Fine-tune Sentinel's behavior with these advanced settings. These options provide more granular control over the monitoring system's behavior and performance.
| Setting | Description | Default | Recommended |
|---|---|---|---|
Data Anonymization |
Automatically anonymize IP addresses and user data for privacy compliance. | Disabled | Based on privacy policy |
IP Address Logging |
Enable to track IP addresses in activity logs for security monitoring. | Enabled | Based on privacy policy |
Role-Based Log Access |
When enabled, editors will only see user, content, and authentication events. Admins see all events. | Disabled | Moderation Policy Based |
Audit Log Access |
When enabled, Sentinel will log whenever a user views the logs or dashboard, including who, when, and from where. | Disabled | Based on privacy policy |
Right to be Forgotten |
Enable GDPR Article 17 compliance - users can request deletion of their personal data from logs. | Disabled | Based on privacy policy |
Data Portability |
Enable GDPR Article 20 compliance - users can export their personal data in machine-readable format. | Disabled | Based on privacy policy |
Batch Processing |
Process logs in batches to reduce server load. Larger batches are more efficient but use more memory. | 1000 entries | 500-2000 |
Right to be Forgotten |
Enable shortcode functionality allowing users to request data
deletion.
Provides GDPR compliance through
[sentinel_data_deletion_request]
shortcode.
|
Disabled | Based on privacy policy |
Performance Considerations
Optimize Sentinel's performance based on your site's traffic and requirements:
Event Registry
Configure which events Sentinel should track and monitor to create a comprehensive security audit trail. The Event Registry is organized into distinct sections for different types of monitoring capabilities.
Event Registry Structure
The Event Registry is organized into three main sections to help you manage different types of monitoring:
🔌 3rd Party Plugin Integrations
Available to all users. Monitor popular WordPress plugins like WooCommerce, Contact Form 7, and Gravity Forms with pre-configured event templates and one-click setup.
📊 System Events Registry
Available to all users. View and control all registered WordPress core events, plugin events, and system activities with detailed filtering and management options.
➕ Custom Events Management
Sentinel+ feature. Create and manage custom events for business-specific monitoring needs, third-party integrations, and specialized tracking requirements.
Available Event Types
Sentinel tracks and logs a comprehensive range of events that range from PHP errors to WordPress core events. Below is a list of some of what Sentinel tracks. This is not a comprehensive list as most events are self-explanatory.
Authentication Events
Core SecurityUser Management
Account ChangesContent Management
Site ContentSystem & Security
Core ChangesEvent Configuration Options
Each event type in the Event Registry includes these configuration options:
Performance Options
While Sentinel is designed to be extremely lightweight with minimal impact on your site, proper optimization ensures it stays that way regardless of your site's traffic volume or activity level.
Batch Logging Configuration
Control how Sentinel processes and stores log entries to balance performance with real-time visibility.
| Setting | Description | Recommended Values | Performance Impact |
|---|---|---|---|
Enable Batch Logging |
Queue logs and write them in batches instead of immediately | Enabled for high-traffic sites | Significantly reduces database writes |
Batch Size |
Number of logs to process in each batch | 50-100 for most sites, 200+ for high-traffic | Higher = better performance, more memory usage |
Batch Frequency |
How often to process batched logs (in seconds) | 60s standard, 30s for real-time needs | Lower = more frequent processing |
Rate Limiting & Spam Prevention
Protect your site from log spam and potential abuse while maintaining comprehensive monitoring.
| Setting | Purpose | Recommended Values | Use Case |
|---|---|---|---|
Per-Minute Limit |
Maximum events logged per minute | 100-200 for normal sites | Prevents log flooding during attacks |
Per-Hour Limit |
Maximum events logged per hour | 1000-5000 based on site activity | Long-term protection against sustained attacks |
Rate Limiting Behavior |
How to handle events when limits are exceeded | Graceful Degradation (recommended) | Maintains visibility while reducing load |
Rate Limiting Behaviors Explained
Smart Memory Monitoring
Prevent memory-related crashes and optimize resource usage with intelligent memory management.
| Feature | Description | Default Setting | Recommended For |
|---|---|---|---|
Memory Monitoring |
Tracks memory usage patterns and provides optimization recommendations | Enabled | All sites, especially shared hosting |
Memory Threshold |
Percentage of PHP memory limit before logging is paused | 80% | Adjust based on site's memory usage patterns |
Smart Recommendations |
Analyzes usage patterns and suggests optimizations | Enabled | Sites wanting automated optimization guidance |
Memory Leak Detection |
Sentinel+ feature. Advanced algorithm detects potential memory leaks by analyzing usage patterns across multiple requests with confidence scoring and smart filtering to reduce false positives. | Disabled (Premium) | Sites experiencing unexplained memory growth or performance degradation |
Performance Optimization by Site Type
Recommended configurations for different types of WordPress sites:
Small Personal/Blog Sites
Settings: Batch logging disabled, standard rate limits (100/min, 1000/hour), memory threshold 80%
Reasoning: Low traffic allows real-time logging without performance impact
Business/Medium Traffic Sites
Settings: Batch logging enabled (50 logs/60s), moderate rate limits (200/min, 3000/hour), memory threshold 75%
Reasoning: Balance between real-time visibility and performance optimization
High-Traffic/E-commerce Sites
Settings: Batch logging enabled (100+ logs/30s), high rate limits (500/min, 10000/hour), memory threshold 70%
Reasoning: Maximum performance with comprehensive monitoring for critical business operations
Shared Hosting
Settings: Conservative batch logging (25 logs/120s), lower rate limits, memory threshold 85%
Reasoning: Resource constraints require careful optimization to avoid hosting limits
Monitoring Performance Impact
Use Sentinel's built-in performance monitoring to ensure optimal operation:
Usage Statistics
Monitor per-minute and per-hour event rates to optimize rate limiting settings
Memory Analysis
Track memory usage patterns and receive automated optimization recommendations
Smart Recommendations
Receive personalized suggestions based on your site's actual usage patterns
Memory Leak Detection (Sentinel+)
Overview
Advanced memory leak detection uses sophisticated algorithms to identify potential memory leaks before they cause serious performance issues or crashes.
How It Works
Pattern Analysis
Monitors memory usage across multiple requests, tracking increases and consistency patterns to identify potential leaks.
Confidence Scoring
Uses advanced algorithms to calculate confidence scores (0-100%) based on consistency, magnitude, and frequency of memory increases.
Smart Filtering
Only alerts when confidence exceeds 70% to minimize false positives from normal memory fluctuations.
Cooldown Protection
Implements 6-hour cooldown periods to prevent alert spam while ensuring critical issues are still reported.
Alert Types
| Confidence Level | Alert Type | Description | Recommended Action |
|---|---|---|---|
| 90%+ | Critical |
Very high confidence this is a real memory leak | Immediate investigation required |
| 70-89% | Warning |
Potential memory leak detected | Monitor and investigate within 24 hours |
| <70% | No Alert |
Insufficient confidence for leak detection | Continue monitoring |
Recommendations Provided
When a memory leak is detected, Sentinel provides context-specific recommendations:
- Urgent Actions: Identify recently changed code, enable debug logging, check for infinite loops
- Investigation Steps: Review activated plugins, check data processing operations
- Optimization Tips: Review image processing, implement pagination, optimize caching strategies
Privacy Settings
Sentinel provides comprehensive privacy and data protection features to help you comply with GDPR, CCPA, and other data protection regulations while maintaining effective security monitoring.
IP Anonymization
Sentinel's intelligent anonymization system masks personally identifiable data in security logs while preserving analytical value for security monitoring and traffic analysis.
How IP Anonymization Works
When triggered (either automatically through deletion requests or manually via admin tools), Sentinel processes IP addresses using a sophisticated masking system:
| Address Type | Original Format | Anonymized Format | Preserved Information |
|---|---|---|---|
IPv4 |
192.168.55.200 | 192.168.xxx.xxx | Network/subnet identification |
IPv6 |
2001:db8::1234:5678 | 2001:db8::xxxx:xxxx | Network prefix for geolocation |
Already Masked |
10.0.xxx.xxx | 10.0.xxx.xxx | No changes (prevents double-masking) |
Anonymization Benefits
Privacy Protection
Removes personally identifiable information while maintaining security monitoring capabilities
Analytics Preservation
Keeps network-level data intact for traffic analysis and security pattern detection
Compliance Ready
Meets GDPR Article 4 requirements for data anonymization and pseudonymization
Security Controls
Sentinel+ provides advanced security controls that enable intelligent threat detection, automated response actions, and sophisticated IP management. These features transform Sentinel from a monitoring tool into an active security protection system.
Security Response Mode
Configure how Sentinel+ responds to detected security threats using the intuitive 3-way toggle control. This setting determines the system's behavior when thresholds are exceeded.
| Response Mode | Behavior | Use Case | Recommendation |
|---|---|---|---|
Observe Only |
Log security incidents without taking automated action | Testing and baseline establishment | Start here for new installations |
Throttle Threats |
Add configurable delays to suspicious login attempts | Slowing down attacks while preserving access | Good balance of security and usability |
Block Threats |
Temporarily block IP addresses that exceed thresholds | Maximum protection for high-risk environments | Recommended for production sites |
Detection Thresholds
Configure sensitivity levels for different types of security threats. These settings determine when Sentinel+ considers an activity suspicious enough to trigger an incident.
Brute Force Detection
Monitors repeated login failures from the same IP address within a specified time window.
| Setting | Default | Range | Description |
|---|---|---|---|
| Failed Attempts | 5 | 3-20 | Number of failed login attempts before triggering incident |
| Time Window | 5 minutes | 1-60 minutes | Time period within which attempts are counted |
User Enumeration Detection
Detects attempts to discover valid usernames through login form probing or author page scanning.
| Setting | Default | Range | Description |
|---|---|---|---|
| Enumeration Attempts | 10 | 5-50 | Number of username discovery attempts before incident |
| Detection Window | 10 minutes | 5-60 minutes | Time period for counting enumeration attempts |
XML-RPC Protection
Monitors XML-RPC endpoint for abuse including brute force attacks and DDoS attempts.
| Setting | Default | Range | Description |
|---|---|---|---|
| Request Limit | 20 | 10-100 | Maximum XML-RPC requests before incident |
| Time Period | 5 minutes | 5-60 minutes | Window for counting XML-RPC requests |
IP Allowlist Management
Configure IP addresses and ranges that should bypass all authentication limits and security checks. This is essential for preventing lockouts of legitimate users and systems.
Allowlist Configuration
Enter IP addresses or CIDR ranges in the allowlist textarea, one per line. Supports both individual IPs and network ranges:
# Office network
192.168.1.0/24
# VPN server
203.0.113.5
# CDN ranges
198.51.100.0/24
203.0.113.0/24
# Localhost variants
127.0.0.1
::1
CIDR Notation Examples
| CIDR Range | Covers | Common Use |
|---|---|---|
192.168.1.0/24 |
192.168.1.1 - 192.168.1.254 | Office network |
10.0.0.0/8 |
10.0.0.1 - 10.255.255.254 | Large private network |
172.16.0.0/16 |
172.16.0.1 - 172.16.255.254 | Corporate VPN |
203.0.113.5 |
203.0.113.5 only | Single server IP |
Response Settings
Configure how Sentinel+ responds when security incidents are detected based on the selected response mode.
Throttle Response
When "Throttle Threats" mode is active, add configurable delays to suspicious requests:
| Setting | Default | Range | Purpose |
|---|---|---|---|
| Throttle Delay | 3 seconds | 1-10 seconds | Delay added to suspicious login attempts |
Block Response
When "Block Threats" mode is active, temporarily block IP addresses that exceed thresholds:
| Setting | Default | Options | Recommendation |
|---|---|---|---|
| Block Duration | 1 hour | 5 minutes - 24 hours | Start with shorter durations, increase as needed |
Admin Trust Mode
Reduce false positives by temporarily bypassing security checks for admin users after successful authentication.
| Setting | Default | Options | Description |
|---|---|---|---|
| Trust Admin IPs | Disabled | Enabled/Disabled | Bypass detection for admin IPs after successful login |
| Trust Duration | 24 hours | 1-24 hours | How long to trust admin IPs after authentication |
Incident Management
Configure automatic incident resolution and notification rate limiting to prevent alert fatigue while maintaining security awareness.
| Setting | Default | Options | Purpose |
|---|---|---|---|
| Auto-resolve Incidents | 6 hours | 30 minutes - 24 hours | Automatically resolve incidents after specified time |
| Notification Cooldown | 30 minutes | 5 minutes - 1 hour | Minimum time between duplicate incident notifications |
Troubleshooting Security Controls
Common issues and solutions for security control configuration and operation.
Why are legitimate users getting blocked?
Common causes:
- Detection thresholds set too low for normal usage patterns
- Admin or power users not included in IP allowlist
- Shared IP addresses from office or corporate networks
- VPN or proxy services triggering multiple user detection
Solutions:
- Add office/VPN IP ranges to allowlist using CIDR notation (e.g.,
192.168.1.0/24) - Enable Admin Trust Mode for administrative users
- Increase detection thresholds gradually while monitoring incidents
- Start with "Observe Only" mode for 1-2 weeks to establish usage baselines
Why isn't my IP allowlist working?
Common causes:
- Incorrect CIDR notation formatting
- Leading or trailing whitespace in IP entries
- Mixing IPv4 and IPv6 formats incorrectly
- Using ranges that don't include your actual IP address
Solutions:
- Validate CIDR notation using online calculators before adding
- Use one IP address or range per line with no extra spaces
- Test with single IP addresses first before using broad ranges
- Check the incident log to see if your IP is being flagged incorrectly
- Check that your public IP hasn't changed (dynamic IPs)
I'm getting too many false positive incidents. How do I reduce them?
Common causes:
- Detection thresholds too sensitive for your site's normal traffic
- Normal user behavior patterns not accounted for
- Automated systems, bots, or monitoring tools included in detection
- Mobile users or shared connections triggering multi-user scenarios
Solutions:
- Increase thresholds gradually while monitoring incident patterns
- Add known service IPs (monitoring, CDN, backup services) to allowlist
- Use longer detection windows for better accuracy (10-15 minutes instead of 5)
- Enable notification cooldown to reduce alert frequency
- Review incident logs to identify patterns before adjusting settings
Security controls aren't activating - incidents logged but no action taken?
Common causes:
- Security Response Mode still set to "Observe Only"
- All or most traffic being allowlisted unintentionally
- Detection thresholds set too high to ever trigger
- Premium license not active for advanced security features
Solutions:
- Verify response mode is set to "Throttle Threats" or "Block Threats"
- Review allowlist entries for overly broad ranges (avoid
0.0.0.0/0) - Lower thresholds temporarily to verify system operation
- Check incident log for "action taken" vs "observed only" entries
- Confirm Sentinel+ license is active and validated
How can I test if security controls are working?
Safe testing methods:
- Check the Activity Log for allowlist bypass confirmations
- Check the Incident Log for recent security events and actions taken
- Temporarily lower thresholds and monitor for expected incidents
- Review activity logs for throttling delays or blocked requests
Testing tips:
- Start testing in "Observe Only" mode to see detection without blocking
- Use a different device or network for controlled testing
- Monitor debug logs for security control activation messages
- Test during low-traffic periods to minimize impact on real users
Data Deletion Request
Implement GDPR "Right to be Forgotten" functionality using the
[sentinel_data_deletion_request] shortcode.
Overview
The data deletion request feature allows users to request the removal of their personal data from Sentinel's logs and databases, helping you comply with GDPR Article 17 (Right to Erasure).
Implementation
Add the shortcode to any page where users can request data deletion:
// Add to your privacy policy page or dedicated deletion request page
[sentinel_data_deletion_request]
// Customize the deletion request form
add_filter('sentinel_data_deletion_form', function($form_html, $user_id) {
// Customize form appearance or add additional fields
return $form_html;
}, 10, 2);
// Handle pre-deletion actions
add_action('sentinel_before_data_deletion', function($user_id) {
// Perform any necessary actions before data deletion
// e.g., notify administrators, log the request
});
// Handle post-deletion actions
add_action('sentinel_after_data_deletion', function($user_id) {
// Perform any necessary actions after data deletion
// e.g., send confirmation email, update external systems
});
What Gets Deleted
When a user requests data deletion, Sentinel will remove the following data:
User Activity Logs
Account EventsPersonal Information
PII DataAdministrative Data
System RecordsBest Practices
Follow these guidelines when implementing data deletion requests:
Clear Communication
Explain what data will be deleted and the implications of the deletion request
Verification Process
Implement proper user verification to prevent unauthorized deletion requests
Confirmation Step
Require explicit confirmation before proceeding with data deletion
Audit Trail
Maintain records of deletion requests for compliance and security purposes
3rd Party Plugin Integrations
Sentinel provides comprehensive monitoring for popular WordPress plugins with automatic detection and one-click setup templates. These integrations are available to all Sentinel users (both Basic and Sentinel+) and require no additional configuration once enabled.
Supported Integrations
Sentinel automatically detects and provides monitoring templates for the following popular WordPress plugins:
WooCommerce
Track orders, payments, inventory changes, and customer interactions with comprehensive ecommerce monitoring.
Contact Form 7
Monitor form submissions, track failures, and analyze user engagement with your contact forms.
WPForms
Track form submissions, payment completions, and user interactions across all your WPForms.
Gravity Forms
Monitor form submissions and payment completions with detailed tracking and analytics.
Key Features
How It Works
Sentinel's third-party plugin integrations work seamlessly with your existing plugins:
Automatic Detection
Sentinel automatically detects when supported plugins are active on your WordPress site.
One-Click Setup
Navigate to Sentinel → Event Registry → 3rd Party Plugin Integrations and click the setup button for your detected plugins.
Automatic Monitoring
Events are automatically created and enabled. Sentinel begins logging plugin activities immediately.
Granular Control
Enable or disable specific events, view detailed logs, and customize monitoring to match your needs.
WooCommerce Integration
Monitor your online store with comprehensive ecommerce event tracking. WooCommerce integration is available in both Sentinel Basic and Sentinel+ with automatic detection and one-click setup templates.
Overview
WooCommerce Integration provides comprehensive monitoring of your online store activities. Track orders, payments, inventory changes, and customer interactions with automated event logging that requires no additional configuration once enabled.
Order Management
Order Management
4 Events1. Navigate to Sentinel → Event Registry
2. Locate '3rd Party Plugin Integrations' section
3. Click 'Setup WooCommerce Events' button
4. Events are automatically created and enabled
5. Control events directly in Plugin Integrations section
6. Monitor orders in Activity Log
Contact Form 7 Integration
Monitor your Contact Form 7 submissions with detailed tracking and failure analysis. This integration automatically detects Contact Form 7 and provides comprehensive form monitoring without any additional configuration.
Overview
Contact Form 7 Integration provides comprehensive monitoring of your contact form activities. Track successful submissions, identify failed submissions, and analyze user engagement with detailed event logging that captures form metadata and submission details.
Tracked Events
The Contact Form 7 integration automatically monitors the following events:
Form Submission Events
2 EventsWPForms Integration
Monitor your WPForms submissions and payments with comprehensive tracking and analytics. This integration supports both WPForms Lite and WPForms Pro, automatically detecting the active version and providing appropriate monitoring.
Overview
WPForms Integration provides comprehensive monitoring of your WPForms activities. Track form submissions, payment completions, and user interactions with detailed event logging that captures form metadata, field information, and payment details.
Tracked Events
The WPForms integration automatically monitors the following events:
Form Submission Events
2 EventsGravity Forms Integration
Monitor your Gravity Forms submissions and payments with comprehensive tracking and analytics. This integration automatically detects Gravity Forms and provides detailed form monitoring capabilities.
Overview
Gravity Forms Integration provides comprehensive monitoring of your Gravity Forms activities. Track form submissions, payment completions, and user interactions with detailed event logging that captures form metadata and submission details.
Tracked Events
The Gravity Forms integration automatically monitors the following events:
Form Submission Events
2 EventsYoast SEO Integration
Monitor your SEO optimization activities with comprehensive tracking of meta changes, score improvements, schema updates, and bulk operations. Yoast SEO integration provides detailed insights into your content optimization workflow.
Overview
Yoast SEO Integration provides comprehensive monitoring of your SEO optimization activities. Track meta field updates, SEO score changes, schema markup modifications, and bulk SEO operations with detailed event logging that captures specific field changes, score improvements, and optimization patterns.
SEO Event Tracking
The Yoast SEO integration automatically monitors the following SEO activities:
SEO Event Tracking
4 EventsSmart Detection Features
The Yoast SEO integration includes intelligent detection capabilities:
Field-Specific Tracking
Distinguishes between different SEO fields (title, description, focus keyword) and provides specific context for each change.
Score Change Detection
Monitors both SEO keyword scores and readability scores separately, tracking improvements and declines.
Bulk Operation Intelligence
Automatically detects bulk operations through pattern recognition and WordPress bulk edit integration.
Schema Type Recognition
Identifies specific schema field changes and provides context about structured data modifications.
Setup Instructions
Setting up Yoast SEO monitoring is automatic once both plugins are active:
Install Yoast SEO
Ensure Yoast SEO plugin is installed and activated on your WordPress site.
Enable Integration
Navigate to Sentinel → Event Registry and click "Setup Yoast SEO Events" in the integration templates section.
Customize Events
Configure which SEO events to monitor and set appropriate priority levels for your monitoring needs.
Setup & Configuration
Learn how to set up and configure third-party plugin integrations in Sentinel. This section covers the complete setup process, configuration options, and troubleshooting common issues.
Initial Setup
Setting up third-party plugin integrations is a straightforward process that requires minimal configuration:
Access Event Registry
Navigate to Sentinel → Event Registry in your WordPress admin dashboard.
Locate Plugin Integrations
Scroll down to the "3rd Party Plugin Integrations" section. Sentinel will automatically detect active plugins and show available setup templates.
Setup Plugin Events
Click the "Setup [Plugin Name] Events" button for each plugin you want to monitor. This creates and enables all relevant events automatically.
Verify Setup
Check the "Plugin-Specific Event Controls" section to see your newly created events. You can enable/disable individual events as needed.
File Monitoring
Monitor critical WordPress files for unauthorized changes with Sentinel's file integrity monitoring system. Detect potential security breaches by tracking modifications to important system files.
Overview
File monitoring tracks changes to critical WordPress files using MD5 hash verification. When files are modified, Sentinel logs the event with detailed information about the change.
How It Works
Sentinel's file monitoring system works through a simple but effective process:
Initial Hash Creation
When file monitoring is enabled, Sentinel creates MD5 hashes of monitored files and stores them as baseline values.
Daily Verification
Every day, Sentinel recalculates the hashes of monitored files and compares them against the stored baseline values.
Change Detection
When a hash mismatch is detected, Sentinel logs the change event with file details and size changes.
Baseline Update
After logging the change, Sentinel updates the stored hash with the new file state for future comparisons.
Setup & Configuration
Configure file monitoring through the Sentinel settings page:
1. Navigate to Sentinel → Settings
2. Go to 'Privacy & Security' tab
3. Enable 'File Monitoring'
4. Configure monitoring frequency (hourly/daily/weekly)
5. Enable 'Exclude Log Files' (recommended)
6. Set alert threshold (default: 10 bytes)
7. Add custom exclusion patterns if needed
8. Set up theme/plugin monitoring (Sentinel+)
9. Save settings
| Setting | Description | Default | Sentinel+ Feature |
|---|---|---|---|
Critical File Monitoring |
Monitor wp-config.php and .htaccess for changes | Disabled | No |
Monitor Custom File Paths |
Monitor additional files beyond core WordPress files | Disabled | Yes |
Monitor Active Theme Files |
Monitor functions.php and style.css of active theme | Disabled | Yes |
Monitor Critical Plugin Files |
Monitor important plugin files for changes | Disabled | Yes |
Real-time File Monitoring |
Immediate detection of file changes (resource intensive) | Disabled | Yes |
Monitoring Frequency |
How often to check files (hourly, twice daily, daily, weekly) | Daily | No |
Exclude Log Files |
Prevent monitoring of debug.log, error.log, etc. (prevents recursion) | Enabled | No |
Custom Exclusion Patterns |
File patterns to exclude (*.log, *.tmp, *.cache) | *.log, *.tmp, *.cache | No |
Alert Threshold |
Minimum file size change in bytes to trigger alerts | 10 bytes | No |
Monitored Files
Sentinel monitors different types of files based on your configuration:
Core WordPress Files (Free)
2 FilesCustom File Path Examples
# Theme files
wp-content/themes/your-theme/functions.php
wp-content/themes/your-theme/style.css
# Plugin files
wp-content/plugins/important-plugin/plugin.php
# Server configs
/etc/apache2/sites-available/your-site.conf
/var/www/html/.htaccess
# Custom files
wp-content/uploads/critical-config.json
Understanding Alerts
When file changes are detected, Sentinel logs detailed information about the modification:
Each file monitoring alert provides comprehensive details to help you assess the significance and legitimacy of file changes:
- File Identity: Complete file name and full system path
- Change Summary: Detailed description (additions, deletions, modifications)
- Size Impact: Exact bytes added or removed from the file
- Timestamps: Previous and current modification times for comparison
- File Classification: Automatic categorization (core, theme, plugin, custom)
- Priority Assessment: Risk level based on file importance and location
💡 Pro Tip: Use the alert threshold setting to reduce noise from minor changes while keeping important modifications visible.
Event Details
| Event Type | Files Monitored | Priority | Description |
|---|---|---|---|
file_modified |
All monitored files | Critical | File monitoring system detected unauthorized changes to critical files |
Change Summary Examples
wp-config.php was modified (+156 bytes) - WordPress configuration file had moderate additions
.htaccess was modified (-23 bytes) - Server configuration file had minor deletions
custom-config.php was modified (same size - content changed) - Critical system file was modified (same size - content changed)
Best Practices
Follow these recommendations for effective file monitoring:
Enable Log File Exclusions
Always keep "Exclude Log Files" enabled to prevent recursive monitoring loops. This prevents debug.log from triggering continuous alerts.
Set Appropriate Alert Thresholds
Use the default 10-byte threshold to reduce noise from tiny file changes. Increase for high-traffic sites that frequently update files.
Choose the Right Monitoring Frequency
Daily monitoring is sufficient for most sites. Use hourly for critical production sites, weekly for development environments.
Use Custom Exclusions Wisely
Exclude cache files, temporary files, and frequently changing logs using patterns like *.cache, *.tmp, backup-*.zip.
Monitor Important Files Only
Focus on critical system files (wp-config.php, .htaccess). Use Sentinel+ for theme/plugin monitoring on development sites.
Use Real-time Monitoring Carefully
Real-time monitoring is resource intensive. Only enable it for critical files that rarely change and require immediate detection.
Troubleshooting
Common issues and solutions for file monitoring:
File monitoring not working
Possible causes:
- File monitoring is disabled in settings
- Files don't exist or aren't readable
- Custom file paths are invalid or outside allowed directories
Solution: Check Sentinel settings in Privacy & Security tab, verify file paths exist and are readable by WordPress.
Too many false positives
Possible causes:
- Alert threshold set too low (detecting tiny changes)
- Log files are being monitored (causing recursion)
- Cache or temporary files being monitored
Solution: Increase alert threshold to 50+ bytes, enable "Exclude Log Files", add patterns like *.cache, *.tmp to custom exclusions.
Debug log recursion (continuous alerts)
Possible causes:
- "Exclude Log Files" is disabled
- debug.log is in custom file paths
- Custom exclusion patterns not working
Solution: Enable "Exclude Log Files" setting, remove debug.log from custom paths, add *.log to exclusion patterns.
Theme/Plugin monitoring not working (Sentinel+)
Possible causes:
- Features disabled in settings
- Theme/plugin files don't exist
- License not active
Solution: Verify Sentinel+ license is active, enable theme/plugin monitoring in settings, check that theme files exist.
Custom file paths not working
Possible causes:
- Invalid path format
- Security restrictions
- Files outside allowed directories
Solution: Use relative paths from WordPress root or absolute paths within allowed directories. Check debug logs for validation errors.
Alerts & Notifications
Configure email alerts and notifications to stay informed about critical security events on your WordPress site.
Notification Types
Sentinel offers three types of notifications:
- Real-time Alerts: Instant email notifications for critical security events
- Daily Digests: Comprehensive daily summaries of site activity and errors
- Weekly Reports: Detailed analytics including health reports and security trends
Setting Up Real-time Alerts
Configure instant notifications for critical events. Navigate to Sentinel → Settings → Notifications to access these settings.
Alert Types & Triggers
Choose which events trigger immediate notifications:
| Alert Type | Trigger Condition | Examples | Recommended |
|---|---|---|---|
Critical Events |
Fires when priority = critical |
Failed admin logins, plugin vulnerabilities, file modifications | ✓ Essential |
Security Events |
Fires when category = security |
Brute force attempts, suspicious IP activity, permission changes | ✓ Essential |
High-priority Events |
Fires when priority = high |
User role changes, plugin installations, theme modifications | ⚠ Use carefully |
Fine-tuning Options
Additional filters to control when alerts are sent:
- Category Filters: Select specific event categories (Authentication, Content, System, Error, Security)
- Priority Filters: Choose priority levels (High, Medium, Low)
- Per-event Control: Disable individual events in Sentinel → Event Registry (affects both logging and alerts)
Email Recipients
Configure who receives alert notifications in Sentinel → Settings → Notifications.
Daily Digest Reports
Aggregated reports sent daily at ~9:00 AM site time via WP-Cron:
Event Summary
daily_summaryError Report
daily_errorUser Activity
daily_userWeekly Digest Reports
Comprehensive weekly reports sent on Mondays at ~9:00 AM site time:
Health Report
weekly_healthPerformance Metrics
weekly_performanceSecurity Summary
weekly_securityRecommended Starter Configuration
Production-ready configuration for development and production environments:
| Category | Recommended Settings | Reasoning |
|---|---|---|
| Real-time | Enable Critical and Security |
Catches the most important events without noise |
| Daily Digest | Enable Error Report and User Activity |
Daily overview of problems and user behavior |
| Weekly Digest | Enable Health and Security |
Weekly health check and security trends |
| Optional | Add Performance if needed |
Only if you care about timing/memory metrics |
Export & Import
Transfer your logs and move your chosen configuration between Sentinel installations with ease.
Data Export
Pull activity records into different formats for review, reporting or regulatory compliance. Whether you're analysing patterns or preparing audits, there's a format to suit your needs.
Supported Formats
- CSV: Great for spreadsheet programs such as Excel or Google Sheets
- JSON: Ideal when connecting to external systems or APIs
- XML: Provides compatibility with older or legacy applications
User Management
Sentinel lets you decide who can see the logs, download data or change settings. Assign abilities based on the role each user plays:
Role-Based Permissions
Control access to Sentinel features based on user roles:
| Role | View Logs | Export Data | Modify Settings |
|---|---|---|---|
| Administrator | ✓ | ✓ | ✓ |
| Editor | ✓ | ✓ | ✗ |
| Author | ✓ | ✗ | ✗ |
Hooks & Filters
Sentinel provides several action hooks that allow developers to extend and integrate with its monitoring system. These hooks fire at key moments in the event lifecycle, enabling you to build custom integrations, notifications, and automation workflows.
Available Action Hooks
These are the actual hooks provided by Sentinel that you can use to extend functionality.
// Triggered after any event is successfully logged
// Parameters: $event_key (string), $event_data (array), $user_id (int)
add_action('sentinel_event_logged', 'my_event_handler', 10, 3);
function my_event_handler($event_key, $event_data, $user_id) {
// Send critical security events to Slack
$critical_events = ['failed_login_attempt', 'user_role_changed', 'plugin_activated'];
if (in_array($event_key, $critical_events)) {
$user = get_user_by('ID', $user_id);
$username = $user ? $user->display_name : 'System';
wp_remote_post('https://hooks.slack.com/your-webhook-url', [
'body' => json_encode([
'text' => sprintf('🚨 Security Event: %s by %s', $event_key, $username),
'attachments' => [
[
'color' => 'danger',
'fields' => [
['title' => 'Event', 'value' => $event_key, 'short' => true],
['title' => 'User', 'value' => $username, 'short' => true],
['title' => 'Data', 'value' => json_encode($event_data, JSON_PRETTY_PRINT)]
]
]
]
])
]);
}
// Log high-priority events to external monitoring service
$priority_events = ['maintenance_mode_enabled', 'security_incident_opened', 'core_file_modified'];
if (in_array($event_key, $priority_events)) {
wp_remote_post('https://monitoring-service.com/api/events', [
'headers' => [
'Content-Type' => 'application/json',
'Authorization' => 'Bearer ' . get_option('monitoring_api_key')
],
'body' => json_encode([
'source' => 'WordPress-Sentinel',
'site' => get_site_url(),
'event_type' => $event_key,
'user_id' => $user_id,
'data' => $event_data,
'timestamp' => current_time('mysql')
])
]);
}
}
// Triggered when a new event type is registered with Sentinel
// Parameters: $event_key (string), $config (array)
add_action('sentinel_event_registered', 'handle_new_event_registration', 10, 2);
function handle_new_event_registration($event_key, $config) {
// Log when new custom events are registered
error_log(sprintf(
'New Sentinel event registered: %s (Category: %s, Priority: %s)',
$event_key,
$config['category'] ?? 'unknown',
$config['priority'] ?? 'medium'
));
// Automatically enable high-priority security events
if (isset($config['category']) && $config['category'] === 'security') {
if (isset($config['priority']) && in_array($config['priority'], ['high', 'critical'])) {
// Ensure this security event is not disabled
$disabled_events = get_option('sentinel_disabled_events', []);
if (in_array($event_key, $disabled_events)) {
$disabled_events = array_diff($disabled_events, [$event_key]);
update_option('sentinel_disabled_events', $disabled_events);
}
}
}
// Notify administrators about new business-critical events
if (isset($config['category']) && $config['category'] === 'business') {
$admin_email = get_option('admin_email');
wp_mail(
$admin_email,
'New Business Event Registered in Sentinel',
sprintf(
'A new business event has been registered: %s\n\nDescription: %s\n\nThis event is now being monitored.',
$event_key,
$config['description'] ?? 'No description provided'
)
);
}
}
// Triggered when a security incident notification is sent
// Parameters: $notification_data (array) containing incident details
add_action('sentinel_security_incident_notification', 'handle_security_incidents', 10, 1);
function handle_security_incidents($notification_data) {
$incident_id = $notification_data['incident_id'] ?? 'unknown';
$event = $notification_data['event'] ?? [];
// Send immediate SMS alert for critical security incidents
if (isset($event['priority']) && $event['priority'] === 'critical') {
// Using a service like Twilio
wp_remote_post('https://api.twilio.com/2010-04-01/Accounts/YOUR_ACCOUNT_SID/Messages.json', [
'headers' => [
'Authorization' => 'Basic ' . base64_encode('YOUR_ACCOUNT_SID:YOUR_AUTH_TOKEN')
],
'body' => [
'From' => '+1234567890',
'To' => '+1987654321',
'Body' => sprintf(
'CRITICAL SECURITY ALERT: Incident #%s detected on %s. Event: %s',
$incident_id,
get_site_url(),
$event['event_key'] ?? 'Unknown'
)
]
]);
}
// Log to external security information and event management (SIEM) system
wp_remote_post('https://your-siem-system.com/api/incidents', [
'headers' => [
'Content-Type' => 'application/json',
'X-API-Key' => get_option('siem_api_key')
],
'body' => json_encode([
'source' => 'WordPress-Sentinel',
'incident_id' => $incident_id,
'site' => get_site_url(),
'severity' => $event['priority'] ?? 'medium',
'event_details' => $event,
'timestamp' => current_time('c')
])
]);
// Create ticket in support system for high-priority incidents
if (in_array($event['priority'] ?? 'medium', ['high', 'critical'])) {
wp_remote_post('https://support-system.com/api/tickets', [
'headers' => [
'Authorization' => 'Bearer ' . get_option('support_api_token'),
'Content-Type' => 'application/json'
],
'body' => json_encode([
'title' => sprintf('Security Incident #%s - %s', $incident_id, $event['event_key'] ?? 'Unknown'),
'description' => sprintf(
'Security incident detected by Sentinel monitoring system.\n\nIncident ID: %s\nSite: %s\nEvent: %s\nPriority: %s\n\nDetails: %s',
$incident_id,
get_site_url(),
$event['event_key'] ?? 'Unknown',
$event['priority'] ?? 'medium',
json_encode($event, JSON_PRETTY_PRINT)
),
'priority' => $event['priority'] ?? 'medium',
'category' => 'security'
])
]);
}
}
Filter Hooks
Currently, Sentinel does not provide any filter hooks for modifying data or behavior. All extension points are provided through action hooks shown above.
Functions
Useful functions for working with Sentinel programmatically.
Core Functions
Essential functions for integrating with Sentinel.
// Log an event
sentinel_log_event($event_type, $message, $user_id = null, $metadata = []);
// Get recent events
$events = sentinel_get_recent_events($limit = 10);
// Check if event type is enabled
$enabled = sentinel_is_event_enabled($event_type);
Classes
Object-oriented approach to working with Sentinel.
Main Classes
Core classes for advanced integration.
// Initialize logger
$logger = new Sentinel_Logger();
// Log an event
$logger->log($event_type, $message, $user_id, $metadata);
// Get events with filters
$events = $logger->get_events([
'user_id' => 1,
'event_type' => 'login',
'date_from' => '2024-01-01'
]);
REST API
Access Sentinel data programmatically via REST API endpoints. The API provides read-only access to activity logs, statistics, and event configuration data for external integrations and monitoring tools.
API Configuration
Enable and configure REST API access through the WordPress admin interface.
Enable API Access
Navigate to Sentinel → Settings → Log Management and check "Enable REST API access"
Test API Access
Verify endpoints are available at /wp-json/sentinel-plugin/v1/
API Key Authentication
Sentinel provides secure API key authentication for REST API access. Generate API keys through the WordPress admin to provide token-based access without requiring WordPress user accounts.
Generating API Keys
Navigate to Settings
Go to Sentinel → Settings in your WordPress admin
Find API Key Section
Locate the "API Key" section below the License Key field
Generate Key
Click "Generate Key" to create a new API key, or "Regenerate" to replace an existing one
Authentication Methods
Include your API key in requests using either method:
curl -H "X-Sentinel-API-Key: YOUR_API_KEY_HERE" \
"https://yoursite.com/wp-json/sentinel-plugin/v1/logs"
https://yoursite.com/wp-json/sentinel-plugin/v1/logs?api_key=YOUR_API_KEY_HERE
JavaScript Example
fetch('https://yoursite.com/wp-json/sentinel-plugin/v1/logs', {
headers: {
'X-Sentinel-API-Key': 'YOUR_API_KEY_HERE'
}
})
.then(response => response.json())
.then(data => console.log('Logs:', data.logs));
Base URL & Namespace
All API endpoints use the following base structure:
https://yoursite.com/wp-json/sentinel-plugin/v1/
API Namespace: sentinel-plugin/v1
Response Format: JSON
Available Endpoints
The following REST API endpoints are currently available:
| Endpoint | Method | Description |
|---|---|---|
/logs |
GET | Retrieve activity logs with filtering and pagination |
/stats |
GET | Get activity statistics and summary data |
/events/types |
GET | List all registered event types and configurations |
GET /logs
Retrieve activity logs with optional filtering and pagination support.
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/logs'
Query Parameters:
limit(integer) - Number of logs to return. Default: 50, Max: 1000offset(integer) - Number of logs to skip. Default: 0event_key(string) - Filter by specific event typepriority(string) - Filter by priority level (low, medium, high, critical)user_id(integer) - Filter by specific user ID
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/logs?event_key=user_login&limit=25&priority=high'
{
"logs": [
{
"id": 123,
"event_key": "user_login",
"category": "authentication",
"priority": "medium",
"user_id": 1,
"ip_address": "192.168.1.100",
"url": "/wp-admin/",
"data": {
"username": "admin",
"success": true
},
"created_at": "2024-01-15 10:30:45",
"user": {
"username": "admin",
"display_name": "Administrator"
}
}
],
"pagination": {
"total": 1250,
"limit": 50,
"offset": 0,
"pages": 25
}
}
GET /stats
Retrieve summary statistics and activity breakdowns.
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/stats'
{
"summary": {
"total_logs": 5420,
"today_logs": 127,
"active_users_today": 8
},
"categories": [
{
"name": "authentication",
"count": 1245
},
{
"name": "content",
"count": 892
}
],
"priorities": [
{
"name": "medium",
"count": 3210
},
{
"name": "low",
"count": 1890
}
]
}
GET /events/types
List all registered event types with their configuration details.
curl -X GET 'https://yoursite.com/wp-json/sentinel-plugin/v1/events/types'
{
"event_types": [
{
"key": "user_login",
"label": "User Login",
"category": "authentication",
"priority": "medium",
"description": "User successfully logs into the system"
},
{
"key": "woo_new_order",
"label": "WooCommerce New Order",
"category": "ecommerce",
"priority": "high",
"description": "New order placed by customer"
}
],
"total": 24
}
Error Responses
Standard HTTP error responses and error codes.
| HTTP Code | Error Code | Description |
|---|---|---|
| 400 | rest_invalid_param | Invalid parameter values (e.g., limit out of range) |
| 403 | rest_forbidden | API access disabled in settings |
| 500 | rest_internal_error | Server error or database issues |
{
"code": "rest_forbidden",
"message": "API access is disabled.",
"data": {
"status": 403
}
}
Integration Examples
Real-world examples of integrating with the Sentinel REST API.
// Monitor login failures in real-time
const fetch = require('node-fetch');
async function checkLoginFailures() {
try {
const response = await fetch('https://yoursite.com/wp-json/sentinel-plugin/v1/logs?event_key=failed_login&limit=10');
const data = await response.json();
if (data.logs.length > 0) {
console.log(`${data.logs.length} recent login failures detected`);
data.logs.forEach(log => {
console.log(`Failed login from ${log.ip_address} at ${log.created_at}`);
});
}
} catch (error) {
console.error('API request failed:', error);
}
}
// Check every 5 minutes
setInterval(checkLoginFailures, 5 * 60 * 1000);
<?php
// External monitoring script
function my_site_activity_summary($site_url) {
$api_url = rtrim($site_url, '/') . '/wp-json/sentinel-plugin/v1/stats';
$response = wp_remote_get($api_url);
if (is_wp_error($response)) {
error_log('Sentinel API error: ' . $response->get_error_message());
return false;
}
$data = json_decode(wp_remote_retrieve_body($response), true);
if (isset($data['summary'])) {
return [
'total_logs' => $data['summary']['total_logs'],
'today_activity' => $data['summary']['today_logs'],
'active_users' => $data['summary']['active_users_today']
];
}
return false;
}
// Usage
$summary = my_site_activity_summary('https://yoursite.com');
if ($summary) {
echo 'Today: ' . $summary['today_activity'] . ' activities by ' . $summary['active_users'] . ' users';
}
?>
import requests
import json
class SentinelAPI:
def __init__(self, base_url):
self.base_url = base_url.rstrip('/') + '/wp-json/sentinel-plugin/v1'
def get_logs(self, **filters):
'''Get activity logs with optional filters'''
response = requests.get(f'{self.base_url}/logs', params=filters)
response.raise_for_status()
return response.json()
def get_stats(self):
'''Get activity statistics'''
response = requests.get(f'{self.base_url}/stats')
response.raise_for_status()
return response.json()
def get_security_events(self, limit=50):
'''Get security-related events'''
return self.get_logs(
event_key='failed_login,suspicious_activity',
priority='high,critical',
limit=limit
)
# Usage
api = SentinelAPI('https://yoursite.com')
# Get today's failed logins
failed_logins = api.get_logs(event_key='failed_login', limit=10)
print(f'Recent failed logins: {len(failed_logins["logs"])}')
# Get site statistics
stats = api.get_stats()
print(f'Total logs: {stats["summary"]["total_logs"]}')
Rate Limiting & Best Practices
Guidelines for responsible API usage and performance optimization.
Recommended Practices:
- Pagination: Use limit and offset parameters for large datasets
- Filtering: Apply specific filters to reduce response sizes
- Caching: Cache responses locally when appropriate
- Error Handling: Implement proper error handling and retry logic
- Monitoring: Monitor your API usage to avoid overwhelming the server
Common Issues
Solutions to frequently encountered problems.
Troubleshooting FAQs
Common issues and their solutions.
Why are some events not being logged?
Check Sentinel → Event Registry to ensure the event type isn’t disabled. Also make sure your role isn’t excluded in Settings → Privacy & Security. If batch logging is on, a stuck queue (sentinel_log_queue) can delay logging until processed.
I enabled “Error events” alerts but I never get them. Why?
In v1.0.0, the “Error events” real-time toggle checks for priority = error, but no events have this priority. Use the Error category toggle instead until fixed in the next release.
Can I send email alerts to multiple addresses?
Not in v1.0.0. Only the first valid email entered in Settings → Notifications is used. To send to more people, use a group/distribution Notifications is used. To send to more people, use a group/distribution email address.
Frequently Asked Questions
Common questions and answers about Sentinel to help you get the most out of your security monitoring.
Does Sentinel slow down my website?
No! Sentinel is designed for minimal performance impact. It uses efficient batch logging, asynchronous processing, and includes performance optimization settings to ensure your site runs smoothly. The plugin typically adds less than 50ms to page load times.
Can I export my activity logs?
Yes! Sentinel includes CSV export functionality for compliance reporting and data analysis. You can export logs by date range, event type, or user. Perfect for security audits, compliance requirements, and long-term record keeping.
Is Sentinel GDPR compliant?
Sentinel provides tools (IP anonymization, data export/deletion, role-based access, audit logs) to help you comply with GDPR, but compliance depends on how you configure and use it. We recommend consulting with legal professionals for full compliance.
How much storage space do the logs use?
Log storage depends on your site's activity level. A typical site with moderate traffic uses approximately 1-5MB per month. Sentinel includes automatic cleanup features to manage storage efficiently, and you can adjust retention periods based on your needs.
Can Sentinel send me email alerts?
Yes. You can configure real-time alerts and daily/weekly digests in Settings → Notifications. In v1.0.0, only one recipient email is supported.
How do I stop logging for certain users or roles?
Use Settings → Privacy & Security to exclude specific user roles from logging. This is useful for developers or staging site admins.
What happens when database logging fails?
Sentinel uses a queue-based retry system to ensure no important events are lost:
- Automatic Queuing: Failed logs are stored in WordPress transients for retry
- Smart Retry: Automatic retry on every admin page load with up to 3 attempts per log
- Manual Retry: "🔄 Retry Failed Logs" button in settings for immediate retry
- No Data Loss: Logs are preserved for 24 hours with automatic cleanup
- Debug Information: Detailed logging shows retry attempts and results
Check the ⚠️ Queued Failed Logs section in Sentinel Settings to see any pending retries.
Can I monitor multiple WordPress sites?
Sentinel is installed per site. To monitor multiple sites, install it on each one. Centralized dashboards could be built using exports or third-party integrations.
Support
Get help when you need it most.
Emergency Issues
If Sentinel is causing site problems, deactivate the plugin immediately via Plugins → Installed Plugins and then contact support with details.
Custom Events
Extend Sentinel's monitoring capabilities beyond WordPress core events by creating and managing your own custom events for specific business logic, third-party plugins, and ecommerce activities.
Overview
Custom Events bridge the gap between WordPress core monitoring and your specific business needs. While 3rd Party Plugin Integrations handle popular plugins like WooCommerce automatically, Custom Events let you create monitoring for unique business logic, specialized workflows, and unsupported plugins.
Creating Custom Events
For unique business requirements or unsupported plugins, create custom events manually through the admin interface.
Access Custom Events
Navigate to Sentinel → Event Registry in your WordPress admin. The Custom Events section appears at the top for Sentinel+ users.
Add New Event
Use the "Add New Custom Event" form to create events with unique keys, descriptive labels, categories, and appropriate priority levels.
Trigger Events
Use sentinel_log_event() in your code to trigger custom
events with relevant data and context.
// Log a custom event
sentinel_log_event('newsletter_signup', [
'email' => $user_email,
'source' => 'homepage_widget',
'user_id' => get_current_user_id()
]);
// Log with custom user context
sentinel_log_event('form_abandoned', [
'form_id' => $form_id,
'completion_percentage' => 75,
'time_spent' => 120
], $user_id);
Developer Hooks & Filters
Extend custom event functionality with WordPress hooks and filters.
// Hook into when events are logged
add_action('sentinel_event_logged', 'my_custom_event_handler', 10, 3);
function my_custom_event_handler($event_key, $event_data, $user_id) {
// Custom logic when any event is logged
if ($event_key === 'user_login') {
// Do something special for login events
update_user_meta($user_id, 'last_login_tracked', current_time('mysql'));
}
}
Parameters:
$event_key(string) - The event key that was logged$event_data(array) - Additional data associated with the event$user_id(int) - ID of the user who triggered the event
// Hook into event registration
add_action('sentinel_event_registered', 'my_event_registration_handler', 10, 2);
function my_event_registration_handler($event_key, $config) {
// React to new events being registered
if ($config['category'] === 'security') {
// Enable special monitoring for security events
update_option('my_security_monitoring_' . $event_key, true);
}
}
Parameters:
$event_key(string) - The event key being registered$config(array) - Configuration array for the event
Advanced Functions
Programmatic functions for custom event management and integration.
// Register a basic custom event
sentinel_register_event('newsletter_signup', [
'category' => 'marketing',
'priority' => 'medium',
'description' => 'User signed up for newsletter'
]);
// Register a security event
sentinel_register_event('suspicious_activity', [
'category' => 'security',
'priority' => 'high',
'description' => 'Suspicious user behavior detected',
'data_fields' => ['ip_address', 'user_agent', 'risk_score']
]);
// Register an ecommerce event
sentinel_register_event('cart_abandoned', [
'category' => 'ecommerce',
'priority' => 'low',
'description' => 'Shopping cart was abandoned',
'data_fields' => ['cart_value', 'items_count', 'user_id']
]);
Configuration Options:
category(string) - Event category: authentication, content, system, security, user, admin, general, auditpriority(string) - Priority level: low, medium, high, criticaldescription(string) - Human-readable descriptiondata_fields(array) - Expected data field namesenabled(bool) - Whether event is enabled. Default: true
Plugin & Theme Integration
Real-world examples of integrating custom events into your plugins and themes.
// In your plugin's main file
class My_Plugin {
public function __construct() {
// Register custom events on plugin activation
register_activation_hook(__FILE__, [$this, 'setup_sentinel_events']);
// Hook into your plugin's key actions
add_action('my_plugin_user_action', [$this, 'log_user_action']);
add_action('my_plugin_error', [$this, 'log_plugin_error']);
}
public function setup_sentinel_events() {
if (!function_exists('sentinel_register_event')) {
return; // Sentinel not available
}
// Register plugin-specific events
sentinel_register_event('my_plugin_action', [
'category' => 'user',
'priority' => 'medium',
'description' => 'User performed action in My Plugin'
]);
sentinel_register_event('my_plugin_error', [
'category' => 'system',
'priority' => 'high',
'description' => 'Error occurred in My Plugin'
]);
}
public function log_user_action($action_data) {
if (function_exists('sentinel_log_event')) {
sentinel_log_event('my_plugin_action', $action_data);
}
}
public function log_plugin_error($error) {
if (function_exists('sentinel_log_event')) {
sentinel_log_event('my_plugin_error', [
'error_message' => $error->get_error_message(),
'error_code' => $error->get_error_code()
]);
}
}
}
// In your theme's functions.php
function my_theme_init() {
// Register theme-specific events
if (function_exists('sentinel_register_event')) {
sentinel_register_event('theme_customizer_changed', [
'category' => 'content',
'priority' => 'low',
'description' => 'Theme customizer settings modified'
]);
}
}
add_action('init', 'my_theme_init');
// Log theme-specific events
function log_customizer_change($setting, $value) {
if (function_exists('sentinel_log_event')) {
sentinel_log_event('theme_customizer_changed', [
'setting' => $setting,
'new_value' => $value,
'changed_by' => get_current_user_id()
]);
}
}
// Hook into WordPress customizer
add_action('customize_save_after', function($customizer) {
log_customizer_change('theme_options', 'bulk_update');
});