You did not sign up for a newsletter. You built a website. Yet your inbox keeps filling with messages from your own site, sent from an address you have never used. Some warn you about updates. Some announce new users. Some just say a comment is waiting.

None of this is a bug. WordPress sends these emails on purpose, and every one of them has a switch. This guide names each email, tells you where the switch is, and shows you which ones to keep. It also covers the small number of messages you should never mute, because they mean something is actually wrong.

The Emails WordPress Sends All by Itself

Before you turn anything off, it helps to know what a stock WordPress install actually sends. No plugins, no theme extras, just core.

There are six common ones. The first is the new user notification, sent to the site admin whenever somebody registers, plus a separate welcome email to that user. The second is the password reset email, sent whenever anyone clicks “Lost your password”. The third is the comment notification, sent when a comment arrives or is held for moderation.

The fourth is the automatic update report. When core, a plugin, or a theme updates itself overnight, WordPress emails you the result. The fifth is the critical error email, which arrives when your site hits a fatal PHP error and enters recovery mode. The sixth is the admin email verification prompt, which is not really an email but a screen that greets you every six months and asks you to confirm the address on file.

All of these leave from wordpress@yourdomain.com unless something changes it. That address usually does not exist as a real mailbox, which is why replies bounce and why some of these messages land in spam.

Why the Volume Suddenly Jumped This Month

Most people do not notice these emails for years, then get twenty in a week. Something changed, and it is usually one of four things.

Auto-updates are the most common cause. WordPress enables automatic updates for minor core releases by default, and since plugin and theme auto-updates became a one-click option, many site owners switched them on and forgot. Every successful update now generates a report.

Open registration is the second cause. If Settings > General has “Anyone can register” ticked, bots will find it. Each fake signup sends you an email. The third cause is a spike in comment spam, which sends a moderation notice for every single attempt. The fourth is a plugin that started emailing you after an update, such as a security tool, a backup tool, or a contact form.

Work out which bucket your flood falls into before you start switching things off. Sorting your inbox by sender and subject for a week tells you more than guessing does, and it stops you muting something you actually need.

Where the Admin Email Address Actually Lives

There are two different admin email addresses in WordPress, and mixing them up causes real trouble. Knowing which is which is the first step to controlling any of this.

The first is the site address at Settings > General > Administration Email Address. This is where site-wide notices go: new user alerts, update reports, and critical error warnings. It does not have to belong to a person who can log in.

The second is your account address at Users > Profile > Email. This one is tied to your login. It receives your own password resets and any notice meant for you personally. Changing one does not change the other, and a lot of “I stopped getting emails” problems come down to somebody updating the wrong field.

There is a practical rule here. Point the site address at a shared team mailbox, so alerts survive a staff change. Keep your account address personal, so nobody else can trigger a reset that lands in a shared inbox. On a site with several administrators, only the site address gets the site-wide notices, so the others will not see update reports at all unless you forward them.

WordPress also checks in on that site address roughly every six months. After you log in, a screen appears asking you to confirm it is still correct. It is easy to click past, but it exists for a good reason: a stale admin address is how sites end up silently unmonitored for years.

Changing the Site Address Without Locking Yourself Out

Type the new address into Settings > General and save. WordPress will not switch straight away. It sends a confirmation link to the new address and shows a small pending notice under the field until somebody clicks it.

That step exists to stop a typo cutting you off from your own site. So check the new inbox before you close the tab, and never point the field at an address you cannot open. If the confirmation never arrives, your site probably cannot send mail at all, which is a different problem covered in our guide to WordPress not sending email.

Turning Off Automatic Update Reports

Update emails are the biggest source of noise on a healthy site, because they arrive even when everything went perfectly. You have two levels of control here, and it is worth using the gentler one first.

Start by trimming what updates itself. Go to Plugins > Installed Plugins and look at the “Automatic updates” column on the right. Each row has an Enable or Disable link. Do the same at Appearance > Themes, where the toggle sits inside each theme’s detail panel. Fewer auto-updates means fewer reports, and it also gives you back control over when things change.

If you want the updates but not the mail, you need a filter. Add a small snippet to a site-specific plugin, or to your child theme’s functions.php:

add_filter('auto_core_update_send_email','__return_false');
add_filter('auto_plugin_update_send_email','__return_false');
add_filter('auto_theme_update_send_email','__return_false');

Those three lines silence successful and failed update reports for core, plugins, and themes. Put them in a child theme rather than the parent, or the next theme update will delete them. And be honest with yourself: if you mute failure reports too, you must check your Updates screen manually every week.

Stopping New User and Registration Emails

If your site does not need public accounts, the fix here is a single tick box, and it solves a security problem at the same time.

Go to Settings > General and untick Membership: Anyone can register. Save. Bots can no longer create accounts, so the alerts stop at the source. While you are there, set New User Default Role to Subscriber, so that if you ever switch registration back on, new accounts get the smallest possible set of permissions.

Some sites genuinely need open registration, such as membership sites and stores. In that case keep registration on but stop the admin copy of the alert with the wp_new_user_notification_email_admin filter, which lets you change or cancel the message sent to the site address while the user still receives their own welcome email.

Before you mute anything, check whether the signups are real. A burst of registrations from addresses you do not recognise is not noise. It is a bot campaign, and the accounts it creates need deleting. Our explainer on WordPress user roles and permissions covers what each role can actually do once it is in.

Comment Notifications Are Usually the Worst Offender

On a site that gets any traffic at all, comments generate more email than everything else combined. Almost all of it is spam that your filter was going to catch anyway.

The controls sit at Settings > Discussion, in a block near the top called “Email me whenever”. There are two boxes. Anyone posts a comment sends you mail for every approved comment. A comment is held for moderation sends you mail for everything in the queue, including spam that was flagged automatically.

For most sites, untick both. The moderation queue does not disappear when you stop the emails. It still sits at Comments in the dashboard with a count bubble next to it, so you can clear a week’s worth in one visit instead of reading fifty notices.

Two other settings on the same screen cut the volume further. Tick Comment author must have a previously approved comment so first-timers queue quietly. And set Automatically close comments on articles older than to something like 60 days, since old posts attract almost nothing but spam.

If comments are not part of your plan at all, close the tap completely. Untick Allow people to submit comments on new posts on the same screen, then use the bulk edit tool on Posts > All Posts to set older posts to “Do not allow” as well. New posts and old posts are handled separately, which is why sites that think they disabled comments still get them.

Some site owners prefer to move the conversation off email entirely. Sending yourself a browser alert instead of a message is one option, and our walkthrough on adding web push notifications to a WordPress site explains how that channel works.

The Emails You Should Never Switch Off

Not every message from your site is noise. A few are the earliest warning you will get that something is broken, and muting them buys silence at the cost of finding out late.

The critical error email is the clearest example. Its subject line says your site is experiencing a technical issue, and it contains a special recovery mode link that logs you in with the broken plugin or theme paused. That link is often the fastest route back into a white screen. If these arrive repeatedly, treat them as a live incident and work through our guide on how to fix the critical error in WordPress.

Failed update reports matter too. A plugin that could not update is a plugin still carrying whatever bug or vulnerability the update was meant to close. So is a sudden run of password reset emails for accounts that did not request one. That pattern means somebody is trying usernames against your login page, and the answer is rate limiting and strong passwords, not a mail filter.

A Sensible Notification Setup for 2026

Pulling it together, here is a configuration that keeps a site owner informed without burying them. It takes about ten minutes.

Leave critical error emails on, always. Leave failed update reports on and mute only the successful ones, so silence genuinely means everything worked. Turn off both comment notification boxes and check the moderation queue in the dashboard once a week. Turn off public registration unless the site needs it, and if it does, keep the admin alert only while you are watching for bot signups.

Then fix the delivery side, because notifications you never receive are worse than notifications you ignore. Point the site address at a real, monitored mailbox rather than a forwarder nobody reads. Send your site’s mail through a proper authenticated service instead of raw PHP mail, so the messages that matter reach you instead of landing in spam.

Finally, review the list every few months. Every new plugin brings its own notifications, and they add up quietly. If you would rather not think about any of this again, the team at 24×7 WP Support manages WordPress sites around the clock in 2026 and monitors these alerts for you, so a real warning gets acted on the same day and the rest never reaches your inbox. Get in touch and we will take it off your plate.

Brian

Brian is a WordPress support specialist and content contributor at 24×7 WP Support. He writes practical, easy-to-follow guides on WordPress troubleshooting, WooCommerce issues, plugin and theme errors, website security, migrations, performance optimization, and integrations. With a focus on solving real website problems, Brian helps business owners, bloggers, and online store managers keep their WordPress sites running smoothly.