wrong alert email

Hello @laserstore !

I’m very sorry to hear that you’ve experienced this issue while using our plugin!

Just to confirm – in the Notifications section you have the notifications set to use a different address but the site still sends those using the default email?

2- Defender doesn’t have a specific feature for preventing SQL injections because those are very difficult to protect against from inside the WordPress code – if a plugin has a vulnerability of this kind, it’s most commonly due to incorrect coding which doesn’t use WordPress functions – those functions are designed in a way to prevent injection attacks through filtering. But if a plugin uses custom database access methods (custom unsafe queries), then there’s hardly anything that can be done to filter this out.

Due to this, the recommended way to handle those kinds of vulnerabilities is to use a server-side Web Application Firewall because it will be able to detect bad requests and prevent them from ever reaching WordPress. Your hosting may offer this kind of feature or you can use the free CloudFlare plan which adds a protection layer to your site.

On the Defender’s side you can still enact some protections which will help prevent those kinds of attacks, especially using the features in the Firewall section. For example you can ban bots which try to scan your site for vulnerabilities before trying out an attack – they will often get caught and get blocked before they are able to cause any harm. Same goes for login protection as some of the db injections can only be attempted when being logged in.

Best regards,
Pawel

Hi @laserstore

I hope you are doing well.

This should be from WordPress itself, had you tested this plugin to check if makes any difference?

https://ww.wp.xz.cn/plugins/cb-change-mail-sender/

Another alternative is trying to configure an SMTP plugin like https://ww.wp.xz.cn/plugins/branda-white-labeling/ https://wpmudev.com/docs/wpmu-dev-plugins/branda/#smtp

Let us know the result you got.
Best Regards
Patrick Freitas

Hey there @laserstore

This is actually a default address that is used in Defender, but it doesn’t actually mean that these emails are getting sent by that address. It is more about masking them in the frontend of email clients, as in the background it is the same method that sends the emails (whatever you use, native wp_mail() or SMTP).

This is something common in plugins and Defender also provides some hooks to actually customize the noreply emails, like:

wd_subscribe_noreply_email
wd_unsubscribe_noreply_email
wd_confirm_noreply_email
wd_lockout_noreply_email

Here you can find an example that you could use in a MU plugin or functions.php file of your child-theme:
https://wpmudev.com/docs/api-plugin-development/defender-api-docs/#filter-wd_subscribe_noreply_email

Let us know if more assistance is needed.

Thank you,
Dimitris