benecaster_invalid_token_recorded
Fires from Security\InvalidTokenMonitor each time a feed request presents a token that matches no row in benecaster_tokens. $current_count is the number of such failures for that show in the last $context['window_minutes'] minutes (default 60), this one included — a true rolling window of per-minute buckets, not a counter that only resets after an hour of quiet.
Revoked tokens never fire this hook, by design. A cancelled subscriber whose podcast app keeps polling produces a revoked lookup every poll — that is a re-engagement signal, not an attack, and counting it would make any show with churn look under attack. An active token presented to the wrong show also classifies as revoked and does not fire it. For every failed poll regardless of type, use benecaster_token_invalid or benecaster_feed_request_dispatched instead.
Per-show counting only: there is no per-IP counter in Benecaster (an attacker rotating IPs would otherwise create unbounded storage). Build a per-source breakdown from $context['ip_hash'] in your own listener. Counting is approximate under concurrent requests. The window is per show — benecaster_invalid_token_alert_threshold can change it — and when that filter switches monitoring off for a show, this action does not fire for it.
Parameters
| Name | Type | Default | Description |
|---|---|---|---|
$show_id |
int |
— | ID of the show the failed lookup was for. |
$current_count |
int |
— | Failures for this show in the last `$context['window_minutes']` minutes, this one included. |
$context |
array |
— | Keys: `ip_hash` (string — salted SHA-256, same salt as the feed request log, never a raw IP), `token_prefix` (string — first 8 characters of the presented token), `user_agent` (?string), `country_code` (?string), `region_code` (?string), `window_minutes` (int). |
Examples
Log every counted failure to your own observability platform
add_action( 'benecaster_invalid_token_recorded', function ( int $show_id, int $current_count, array $context ): void {
error_log( sprintf( 'Show #%d: %d failed token attempts in the last %d min', $show_id, $current_count, $context['window_minutes'] ) );
}, 10, 3 );Notes
Distinct from benecaster_token_invalid, which fires for every failed lookup (revoked included), before revoked and not-found are told apart, and carries only ( $token_prefix, $show_id ). See the recipe above for a per-source breakdown.
Need this built rather than just documented? See our services →