The scheduled tasks

Why you are reading this

You opened WP Crontrol, or ran wp cron event list, and found five events whose names start with attrua_. This page says what each one is and whether you can leave it alone.

All five belong to Pro. The free plugin schedules nothing.

The five

Each is registered with wp_next_scheduled() guarding wp_schedule_event(), so they are created once and never duplicated, even across reactivations.

What each one does when it runs

attrua_audit_log_cleanup — daily

Deletes audit entries older than the retention period set on the Audit Log screen. Without it the audit table grows for as long as the site runs. This is the event most worth confirming on a busy site.

attrua_cleanup_expired_ips — daily

A blocked or allowed IP can carry an expiry date. This event removes the ones that have passed. The IP Manager screen also offers a Clean Up Now button that does the same work immediately, which is the manual answer when cron is unreliable.

attrua_pro_daily_tasks — daily

Sends the "your password expires soon" notifications. It is registered only when password expiry is switched on, so if you never enabled expiry you will not see this event at all.

attrua_check_scheduled_maintenance — hourly

Maintenance mode can be scheduled for a window. Nothing turns it on at the appointed minute except this event — WordPress has no timer of its own.

attrua_check_scheduled_messages — hourly

The same shape for broadcast messaging: a message scheduled for later is sent when this event next runs. Large sends are then handed to a batch hook, so the message goes out over several runs rather than in one request.

attrua_pro_purge_expired — daily

Deletes magic links whose expiry has passed, and failed-attempt counters older than your audit retention period, so neither table grows without limit.

The failed-attempt rows carry an IP address and a browser string, so this is also the task that puts a stated limit on how long the plugin keeps that. To set it apart from the audit log's retention:

add_filter( 'attrua_pro_login_attempts_retention_days', function () {
    return 7;
} );

If your site has no real cron

WP-Cron is not a scheduler. It runs on page loads, so a site with no visitors runs nothing.

What that costs you, in order of consequence:

1. Scheduled maintenance never opens or closes. The window you set does not happen.
2. Scheduled broadcasts never leave. They sit as scheduled and are not sent.
3. Password expiry warnings stop. Accounts still expire; people are just not warned first.
4. The audit log and the IP lists grow. Nothing breaks; the tables get larger.

The expiry purge is the exception: it catches up on an admin page load, so magic links and failed-attempt counters are swept even where cron is broken.

If any of the first three matter to you, disable WP-Cron and drive it from the operating system instead:

// wp-config.php
define( 'DISABLE_WP_CRON', true );

# then, every five minutes
*/5 * * * * cd /path/to/site && wp cron event run --due-now --quiet

Five minutes is a reasonable interval for the hourly events above: it does not make them run more often than hourly, it makes the hour boundary land on time.

Removing them

Deactivating Pro leaves the events registered until WordPress next prunes them. To clear one by hand:

wp cron event delete attrua_check_scheduled_messages

They are recreated on the next admin page load while the plugin is active, so deleting an event is a way to force a reschedule, not a way to switch a feature off. Switch the feature off on its own screen instead.