Get a Telegram message the moment someone logs in
Set up Telegram login notification WordPress administrators can trust: every login sends a Telegram Bot API message, with a fully editable template, per-role filtering and an encrypted bot token.
- Fire-and-forget Telegram Bot API message on every wp_login.
- Filter notifications to specific roles only.
- Editable template with username, role, IP and time placeholders.
- AES-256-GCM encrypted bot token, verified with a live test.
Telegram login notification WordPress: what does the module do?
This is what a Telegram login notification WordPress setup does under the hood: when the telegram_login_notify module is active and a bot token and chat ID are saved, TOWP_Telegram_Login_Notify hooks into wp_login and posts a message to the Telegram Bot API for every successful authentication. Administrators write the message themselves using placeholders for the username, display name, email, role, site name, site URL, login date and time, and IP address, and can optionally restrict notifications to specific roles. A "Get Chat ID from bot" helper and a "Send test message" button let the setup be verified before relying on it.
A login you did not expect is easy to miss
WordPress does not tell anyone, in real time, that a user just signed in — successful logins simply happen and move on.
Log files only help if someone reads them
Without a live alert, an unexpected administrator login is indistinguishable from a normal one until somebody opens a log file, an audit plugin dashboard, or a security report — often long after the session that mattered.
Email alerts compete with everything else in the inbox
A dedicated intrusion alert should reach a channel that gets checked immediately, not one more line in an inbox that already receives newsletters, invoices and support tickets.
Turn every login into a Telegram message
The module hooks a single WordPress action, resolves a template with real login data and posts it to the Telegram Bot API — no separate logging service, inbox or dashboard required to notice a login as it happens.
Message on every login
The wp_login action fires the notification with the resolved template and real user data, sent to the configured chat, group or channel.
Filter to the roles that matter
Check one or more roles to notify only for those; leave every role unchecked to be notified for any successful login.
Fire-and-forget delivery
The live request uses 'blocking' => false, so the outbound call to Telegram does not delay the login response.
The complete Telegram login notification WordPress feature set
Every capability below is present in the settings renderer, the notification class or the AJAX handlers.
Bot Token and Chat ID
Enter the token from @BotFather and the destination chat, group or channel ID; the chat ID field accepts negative numbers for groups and channels.
Roles to monitor
A checkbox per registered WordPress role; matching also checks additional roles assigned through Multi Role Assignment.
Editable message template
A textarea with clickable placeholder chips for username, display name, email, role, site name, site URL, date/time and IP; supports Telegram Markdown.
Get Chat ID from bot
Calls the Telegram getChat and getUpdates methods to list candidate chats and lets the admin click one to fill the field.
Send test message
Sends a real, blocking request using the current form values — even before they are saved — and reports success or the Telegram API error.
Encrypted token
The bot token is encrypted with AES-256-GCM before it is stored, and decrypted only at the moment a Telegram API call is made.
Set up Telegram login notification WordPress in four steps
Verify delivery with a test message before depending on it for real intrusion alerts.
Create a bot with @BotFather
Message @BotFather on Telegram, create a bot and copy the token it gives you into the Bot Token field.
Set the destination chat
Message the bot directly, or add it as admin to a group or channel, then use "Get Chat ID from bot" to find and fill the Chat ID field.
Customize the message and roles
Edit the template with the placeholder chips and, if needed, check only the roles that should trigger a notification.
Send a test message
Use "Send test message" to confirm delivery, then save the settings so the live wp_login notification is armed.
Where a Telegram alert helps most
The module fits sites where a small number of people need to know about a login immediately, not after the fact.
Low-traffic admin sites
On a site with only a few people who ever sign in, an unexpected login stands out immediately in a channel that gets checked in real time.
Agencies managing client sites
Route notifications for client-site logins to a dedicated Telegram group so the whole team sees administrator activity as it happens.
Sites with privileged roles
Filter the "Roles to monitor" list to Administrator and Editor so only logins that matter generate a message.
An intrusion alarm that costs nothing extra
The module reuses a channel most administrators already have open, without a separate logging service or paid alerting tool.
One hook, no dedicated assets
The verified implementation adds no separate stylesheet or script file and keeps the outbound call off the critical login path.
No dedicated CSS or JS file
The settings panel and its small autosave/test-message scripts are rendered inline by the settings renderer, not enqueued as separate assets.
Non-blocking live request
The wp_login notification is sent with 'blocking' => false and an 8-second timeout, so it does not wait for a Telegram response.
AJAX actions only when active
The three Telegram wp_ajax_* callbacks are registered only when the module is enabled, and the login hook is only added once a token and chat ID are present.
Encrypted at rest, restricted to administrators
The code encrypts the bot token, protects every AJAX action and sanitizes each stored value according to its type.
AES-256-GCM token encryption
The bot token is encrypted on save with a key derived from AUTH_KEY and AUTH_SALT via hash_hkdf(), and decrypted only when a Telegram API call is made.
Nonce-protected AJAX
The test-message, chat-ID-lookup and message-autosave endpoints all call check_ajax_referer( 'towp_nonce', 'nonce' ).
Administrator-only actions
Every Telegram AJAX handler requires the manage_options capability before it does anything.
Type-aware sanitization
The chat ID is sanitized as a signed integer to preserve negative group and channel IDs, and the message template is sanitized as multiline text so line breaks survive.
Built on core hooks and the Telegram Bot API
The supplied code integrates through a native WordPress action and the plugin's own AJAX and encryption layers. No compatibility claim beyond the verified implementation is assumed.
wp_login
The single hook used to detect a successful login and trigger the notification, receiving the username and the WP_User object.
Multi Role Assignment
Role filtering also checks additional roles stored in the towp_extra_roles user meta key used by the Multi Role Assignment module.
Telegram Bot API
Outbound requests target api.telegram.org using sendMessage, getChat and getUpdates, sent through wp_remote_post().
TheOneWP versus common alternatives
Compare a real Telegram login notification WordPress implementation with typical combinations of security plugins, email alerts or custom code.
| Capability | TheOneWP Telegram Notify | Other common solutions |
|---|---|---|
| Delivery channel | Telegram Bot API, reaching a chat, group or channel | Usually email, which competes with an already full inbox |
| Role-based filtering | Built-in checkbox list, Multi Role Assignment aware | May notify for every login or require custom code to filter |
| Message content | Fully editable template with 8 placeholders and Markdown | Often a fixed subject/body with limited or no customization |
| Bot token storage | AES-256-GCM encrypted, decrypted only when needed | Storage method varies by plugin or custom snippet |
| Built-in verification | "Get Chat ID from bot" lookup plus a live test-message button | Chat IDs and delivery are often found and tested manually |
| Login-path impact | Fire-and-forget request, does not block the login response | Behaviour depends on how the notification call is implemented |
| Administration | One TheOneWP settings panel with nonce-protected AJAX controls | May require a separate plugin, service account or hosting rule |
Get a reliable alert, not a noisy one
A few habits keep the notification useful instead of becoming a channel nobody reads.
Message the bot before testing
Send /start (or any message) to the bot, or add it as admin to your group or channel, before requesting a chat ID or a test message.
Verify with a real test message
Use "Send test message" after entering the token and chat ID, and again after any change, before relying on the live notification.
Filter to roles that actually matter
On sites with many contributor or subscriber logins, check only Administrator and Editor to keep the channel meaningful.
Use a dedicated chat or channel
A channel used only for this notification is easier to scan than mixing it into a busy personal or team chat.
Avoid assumptions that break delivery or expectations
The module has a defined scope: sending one templated message through the Telegram Bot API on login.
Never messaging the bot first
A bot cannot deliver to a chat it has not seen. Without an initial /start message, or admin rights in a group or channel, requests fail with "chat not found."
Enabling the toggle without a token and chat ID
The wp_login hook is only registered once both the token and chat ID are present; the switch alone does not arm the notification.
Treating it as an audit log
The module sends one message per matching login. It does not store a login history, log failed attempts or replace a dedicated access log.
Telegram User Access Notification FAQ
These answers are derived from the verified class, settings renderer, sanitization rules and AJAX handlers.
What is Telegram login notification WordPress in TheOneWP?
It is the Telegram User Access Notification module: when telegram_login_notify is active, TOWP_Telegram_Login_Notify hooks into wp_login and sends a message through the Telegram Bot API every time a user authenticates. The message text is a template with placeholders that are resolved at login time.
Which logins trigger a message?
By default, every successful login triggers a message. If one or more roles are checked in "Roles to monitor," a login only sends a message when the user's primary role or any additional role assigned via Multi Role Assignment matches one of the checked roles.
Is the bot token stored in plain text?
No. The token is encrypted with AES-256-GCM using a key derived from AUTH_KEY and AUTH_SALT via HKDF before it is saved, and decrypted only when the plugin needs to call the Telegram API. If OpenSSL is unavailable or AUTH_KEY/AUTH_SALT are not defined, the token cannot be saved and the settings panel shows a dependency notice.
Does sending the Telegram message slow down login?
No. The live notification sent on wp_login is fired with 'blocking' => false and an 8-second timeout, so WordPress does not wait for the Telegram API to respond before finishing the login request. The manual "Send test message" button uses a blocking 10-second request instead, so its result can be shown to the administrator.
Can I use a group or channel instead of a personal chat?
Yes. The Chat ID field accepts negative numeric IDs, which Telegram uses for groups, supergroups and channels. The value is sanitized as a signed integer so the leading minus sign is preserved.
What if the test message fails with "chat not found"?
This means the bot cannot deliver to that chat ID. The panel's help note explains the fix: message the bot directly at least once (e.g. /start), add the bot as an administrator for a group or channel, and use the correct ID format before retrying.
How do I find the Chat ID without knowing it in advance?
Click "Get Chat ID from bot." The plugin calls the Telegram getUpdates method to list chats the bot has recently seen, and — if a value is already typed in the Chat ID field — also calls getChat to verify that specific ID. Matching chats are shown as a clickable list that fills the field.
Who can change these settings or trigger a test message?
Every admin action — saving the message template, requesting chat IDs and sending a test message — goes through wp_ajax callbacks that require the manage_options capability and verify the towp_nonce nonce.
Stop wondering who just logged in.Get a Telegram message instead.
Use this Telegram login notification WordPress module to turn every matching login into a message on the channel you already check.