Troubleshooting WP Cerber Email Notifications

If a WP Cerber notification doesn’t arrive, email diagnostics can help you find out what happened when the plugin tried to send it. This is especially useful when test emails arrive but security alerts or scheduled reports do not.

Email diagnostics record WP Cerber’s email sending attempts. They do not track messages from other WordPress plugins or confirm that a message reached the recipient’s inbox. Turning on diagnostics also does not change your email delivery settings or remove notification limits.

Before you start

Check the affected notification

Confirm that the notification is enabled and that its recipients are correct. For an activity alert, check its conditions, email channel, expiration date, and notification limit. For lockout notifications, check the configured lockout threshold and the limit on alerts per hour. A recorded security event does not always require an email to be sent.

Check whether a plugin changes your uploads folder

Check first if a plugin, theme, or customization controls your local uploads folder. A setting that lets you choose that folder is a reason to check compatibility. Some configurations can make WP Cerber lose track of its diagnostic log and quarantine, leaving files on disk but unavailable through the dashboard. If you use this kind of setup or are unsure, leave email diagnostics off.

A fixed location already set through UPLOADS in wp-config.php or WordPress’s upload_path option does not cause this issue by itself. Another plugin can still override it.

1. Enable email diagnostics

After completing the uploads-folder check above, save a copy of your site’s wp-config.php file. Add this line inside its existing PHP section, above the line that loads wp-settings.php:

define( 'CERBER_MAIL_DEBUG', true );

If the file already defines CERBER_MAIL_DEBUG, change its value to true instead of adding another definition.

2. Send a test notification

Open the WP Cerber Notifications settings and use Click to send test beside Lockout notification. Note the time and whether the test email arrived. If it did not arrive, check the intended mailbox, including its spam folder, and note any error shown by WP Cerber.

Next, collect records for the notification that is actually missing. A successful dashboard test does not confirm that an activity alert met its conditions, that a scheduled report ran, or that a notification created earlier in a request followed the same sending path.

For an intermittent alert, keep diagnostics enabled only as long as needed to observe the next relevant event. Record the time and your time zone so you can find the corresponding entries. Avoid changing email settings between the test and the affected notification, since that makes the results harder to compare.

You do not need to attack your site or deliberately lock yourself out to generate a record. If there is no safe way to reproduce the event, wait for it to occur naturally.

3. Review the diagnostic log

Go to WP Cerber → Tools → Diagnostic Log and look for entries marked [MAIL] around the times you recorded for the test and the affected notification. Use Download log if you need a file, or copy the relevant entries as text. Text preserves the complete records and is easier to review than a screenshot of a long line.

Each entry starts with explain, a one-sentence summary of that sending attempt in plain English. The technical fields that follow are what support uses to investigate.

The examples below are illustrative. They show the [MAIL] portion of each entry, without the date and time prefix added by the Diagnostic Log.

Example: a dashboard test

[MAIL] explain="WordPress reported success for recipient 1 of 1 with WP Cerber SMTP disabled." ts=2026-11-06T15:20:00Z rid=EXAMPLETEST01 type=lockout dispatch=direct cwd=inside_abspath pwd=none cwd_send=inside_abspath pwd_send=none recipient=1 recipients=1 attempt=initial smtp=disabled result=ok

Example: a lockout notification sent as a request finishes

[MAIL] explain="WordPress reported success for recipient 1 of 1 with WP Cerber SMTP disabled." ts=2026-11-06T15:25:00Z rid=EXAMPLEALERT02 type=lockout event=708 dispatch=shutdown cwd=abspath pwd=none cwd_send=root pwd_send=none recipient=1 recipients=1 attempt=initial smtp=disabled result=ok

Both example calls returned success. Their different sending paths and working-directory categories can help support compare the test with the real notification, but do not establish why a message failed to arrive.

Use the ts field when comparing times. It is always in UTC, indicated by the final Z. The Diagnostic Log’s separate date and time prefix may use a different time zone.

4. Understand the result

result=ok does not confirm delivery to the recipient. It means the WordPress email function returned success for that call. WordPress explains this distinction in its email function documentation. The same applies to “WordPress reported success” in the explain text, and a failed attempt in explain does not identify the cause of the failure.

Settings or rate limits can prevent a sending attempt. A record can also be missing if the log could not be written or execution stopped before the email function returned. An absent entry does not establish that the hosting provider blocked the message. Tell support if a known test produces no record.

5. Turn off diagnostics after collecting the records

Once you have captured the relevant attempts, change the existing definition to:

define( 'CERBER_MAIL_DEBUG', false );

You can also remove the line you added. Do not add a second definition. If support helped establish a fixed storage path for your site, keep that separate setting in place.

This stops new email diagnostic entries. Existing records remain in the Diagnostic Log. Save what you need before using Clear log, which clears the shared log, including entries from other WP Cerber features.

6. Share the relevant details with support

Choose the channel for your version:

• WP Cerber Professional: Open a private ticket in the WP Cerber support portal.
• Free version: Start a topic on the WP Cerber community forum.

Include the following details:

• Your WP Cerber version and the notification that is missing.
• When it was expected, including your time zone.
• Whether the dashboard test arrived.
• The relevant [MAIL] entries.
• Whether you use WP Cerber’s SMTP settings or another WordPress mail plugin.

If WP Cerber displays an email error, include it in your private ticket. In a public topic, mention that an error appeared and avoid posting details that identify users or accounts.

For a security notification, a related Activity Log entry can also help. Share Activity Log entries privately, as they can contain IP addresses and usernames. To find the entry, copy the mail record’s rid, open the Activity Log, click More, enter it in Request ID, and click Filter. See What is RID and how to use it.

The new [MAIL] lines described in this guide omit email addresses, IP addresses, subjects, message bodies, credentials, and raw filesystem paths. You can share those individual lines in a public forum topic. Copy only the relevant [MAIL] lines, without surrounding log entries or screenshots that include other data.

Full Diagnostic Log exports can contain entries from other WP Cerber features and should be shared privately. If you use the free version and a staff member requests an Activity Log entry or a full export, ask them how to send it privately before sharing it. Do not include passwords or your complete wp-config.php file. Share recipient addresses only through a private channel when needed.

Field reference

You can share the records with support without decoding every field. This reference explains the extra context if you want to take a closer look.

The event field is omitted when no applicable code was supplied. Dashboard tests may omit it, but an absent event does not by itself identify a test message.

Sending paths

These values describe WP Cerber’s sending path. They do not identify an SMTP server or describe a mail provider’s delivery queue. In particular, direct does not tell you whether SMTP was used.

SMTP decisions

This field reflects WP Cerber’s configuration only. Another plugin can still change how WordPress sends the message, so enabled does not prove that the configured SMTP server was used.

Directory categories

The log uses categories instead of recording actual paths.

pwd=none and dispatch=shutdown are not errors by themselves. A change such as cwd=abspath followed by cwd_send=root is useful evidence about the sending environment, but it does not prove a delivery failure. Matching categories also do not guarantee matching paths, and the before-call snapshot does not show changes made inside the email function or its hooks.

On servers with PHP’s open_basedir restriction, a PWD path that reaches the WordPress directory through a symbolic link may be classified as outside_abspath. Support can take that limitation into account when reviewing the entries.

Why one notification can produce several records

Each recorded call has its own result. Multiple recipients or an existing SMTP fallback can produce more than one record for a notification. A single request can also generate different notifications.

For example, a notification with two recipients and an unreachable SMTP server can produce these three records, shown here with the technical fields omitted:

[MAIL] explain="The email attempt for recipient 1 of 2 failed with WP Cerber SMTP enabled." ... recipient=1 recipients=2 attempt=initial smtp=enabled result=error
[MAIL] explain="WordPress reported success for the retry to recipient 1 of 2 without WP Cerber SMTP settings." ... recipient=1 recipients=2 attempt=retry smtp=bypassed result=ok
[MAIL] explain="WordPress reported success for recipient 2 of 2 without WP Cerber SMTP settings." ... recipient=2 recipients=2 attempt=initial smtp=bypassed result=ok

The SMTP attempt failed, and both later calls were made without WP Cerber’s SMTP settings. Nothing here shows that the SMTP server recovered or that either message arrived.

Recipient numbering restarts with each notification, and email addresses are deliberately omitted, so a position does not tell you which address was used. Keep all related entries when reporting a problem, even when an error is followed by an ok.

Known issue: changes to the local uploads folder

This issue affects sites where a plugin, theme, or customization makes WP Cerber see different local uploads base folders during early requests and normal dashboard requests. For example, a plugin may change that folder only after it loads.

WP Cerber uses the uploads location to find its shared storage folder. If the existing folder is not found at the other location, WP Cerber can create a new folder and lose track of the old one. The old files remain on disk, but quarantined files may disappear from the quarantine page and become unavailable for restoration there. Diagnostic records can also end up in different folders.

A fixed location configured through UPLOADS in wp-config.php or the upload_path option does not cause this startup inconsistency by itself. A plugin or customization can still override it later. Likewise, a plugin’s local-folder setting is a reason to check how it works, rather than proof that the site is affected. These are examples of existing configurations, not instructions to change your uploads settings.

If your setup may be affected, leave email diagnostics off and get help. Include the name of the plugin, theme, or customization that controls the uploads location.

Keep all existing wp-cerber-* folders and their contents in place. Do not move, rename, or delete them, change the uploads plugin’s settings, or try a guessed storage path. The correct setup must preserve the folder WP Cerber already uses.

If diagnostics are already enabled on an affected site, turn them off while the storage location is checked. This does not restore WP Cerber’s connection to a previous folder. Other WP Cerber functions can still trigger the storage issue.

Have any questions?

If you have a question regarding WordPress security or WP Cerber, leave them in the comments section below or get them answered here: G2.COM/WPCerber.