How to Get Alerted When a WordPress Security Plugin Is Deactivated

A security plugin that is switched off protects nothing, and attackers often turn it off first. Zapify watches one plugin you choose and emails you the moment it is deactivated, with the name of the person who did it. It uses the free A plugin is activated or deactivated trigger with its Plugin and Status fields set, and the Send an email action.

What this automation does

The automation is one trigger plus one action:

• Trigger: A plugin is activated or deactivated (WPADMIN_PLUGIN_STATUS_CHANGED, WP Admin), set to one plugin and the Deactivated status
• Action: Send an email (WP_SEND_EMAIL, WordPress)

When that one plugin is deactivated, Zapify emails the address you set. Every other plugin is ignored, because the filter sits on the trigger itself.

The same setup works for a firewall, a backup plugin, a caching plugin or anything else that must stay on.

Before you start

• The plugin you want to protect, installed on the site.
• A working email setup on your site.

How to build the automation

Step 1: Create a new automation

1. In the WordPress admin, go to Zapify → Automations.
2. Click Add New to open the builder.
3. Name it clearly, such as Alert me when the security plugin is turned off.

Step 2: Add the "A plugin is activated or deactivated" trigger

1. Click Add Trigger.
2. Choose WP Admin as the app.
3. Select the trigger A plugin is activated or deactivated.
4. In the Plugin field, pick your security plugin.
5. In the Status field, choose Deactivated.

Step 3: Add the "Send an email" action

1. Click Add Action.
2. Choose WordPress as the app.
3. Select Send an email.

Step 4: Write the email

Use the {} token button beside any field to insert the details of the event.

Field	Required	What it does
To	Yes	Type the address that should get the alert. Separate several addresses with commas.
Subject	Yes	The subject line. Tokens are allowed.
Format	Yes	HTML (default) or Plain text.
Body	Yes	The message. Tokens are allowed.
Cc / Bcc	No	Extra recipients.
From name / From email	No	Override the sender.
Reply to	No	Where replies go.

For example:

• To: security@example.com
• Subject: Security plugin switched off: {Plugin name}
• Body: {Plugin name} was deactivated by {Actor username}. Log in and check the site right away.

Step 5: Set the steps Live and save

1. Set both the trigger and the action to Live. A new automation starts as Draft and will not run until its steps are Live.
2. Click Save.

Tokens you can use

Token	What it holds
Plugin name	The plugin's name, read from the plugin on disk.
Plugin file	The plugin's file inside the plugins folder, such as akismet/akismet.php.
Plugin version	The version installed now. After an update this is the new version.
Plugin author	The author named in the plugin.
Status	activated or deactivated.
Network-wide	yes or no.
Actor user ID / Actor username	The logged-in person who did it. Empty (and 0) when nobody was logged in, as with an automatic update.

How to test it

1. Deactivate the plugin you chose on a staging copy of the site, or briefly on the live site.
2. Check the inbox for the alert, then reactivate the plugin.
3. If nothing arrives, open Zapify → Logs to see whether the run fired.

Do not test this by deactivating a security plugin on a live site that is under attack.

Conclusion

With the free A plugin is activated or deactivated trigger set to one plugin and the Deactivated status, a switched-off security plugin never goes unnoticed. For a full record of every change, see emailing on any activation or deactivation, or alert a channel instead of an inbox with Slack.

FAQs

Does it also catch the plugin being deleted?

Not the deletion itself. WordPress only lets you delete a plugin once it is inactive, so the deactivation that came first is reported. A plugin removed straight from the server's files, without WordPress involved, is not reported at all.

Can I watch more than one plugin?

Yes. Make one automation for each plugin, or leave Plugin on Any plugin and set Status to Deactivated to hear about every deactivation.

What if an attacker disables the plugin from outside WordPress?

Zapify can only see changes made through WordPress, because it listens to WordPress's own events. Pair this alert with file monitoring from your host or security plugin.

Is this feature free?

Yes. WP Admin is a free Zapify integration, and the trigger, its plugin and status filters, and the Send an email action are all in the free plan.

Why didn't the email arrive?

Open Zapify → Logs. If the run succeeded but no email arrived, the cause is usually the site's mail configuration. An SMTP plugin resolves most delivery problems. Check the spam folder too.

Do I need to write any code?

No. Everything is configured in the Zapify visual builder.