WP Activity Log Pro

Almost no WordPress scare is an attack: it is a change nobody remembers

One Monday the shop stops sending emails, a page disappears or the menu looks different. The first thought is an attack. What is usually behind it is more ordinary: someone deactivated a plugin, changed a setting or edited a page, and does not remember.

On a site where several people work, without a log every incident ends in an argument from memory: who touched what, when and from where. And while people argue, the problem is still there.

WP Activity Log Pro, by Melapress, records every change with its date, its user and its origin. It prevents nothing: it turns the question of who did it into a search.

What WP Activity Log records

• Content: posts, pages and custom post types, with changes to status, title, URL or custom fields, plus tags, categories, widgets and menus.
• Users: sign-ups, deletions and changes to password, email, display name or role.
• Access: logins, logouts, failed attempts and terminations of other sessions.
• Plugins and themes: installs, activations, deactivations, uninstalls and updates.
• Core and settings: updates, permalinks, default role or site URL, and tables a plugin creates or deletes.
• Files added, modified or deleted.
• Other plugins such as WooCommerce (settings, orders, products and coupons), Yoast SEO, Rank Math, ACF, Gravity Forms or WPForms.

What Premium adds: search, alerts and session control

Each event stores the date and time to the millisecond, user and role, source IP and the affected object. The free edition does not limit what is collected; Premium adds what you need to use it day to day.

Search and filters over the log, reports in HTML or CSV that can be scheduled daily, weekly, monthly or quarterly, and alerts by email, SMS or Slack.

Real-time sessions: terminate sessions remotely, block simultaneous sessions for the same account and close idle ones.

Storing it elsewhere: an external database, archiving and mirroring to services such as AWS CloudWatch, Loggly, Papertrail or Slack.

What the log does not solve on its own

The time span. By default it keeps three months. If a problem is discovered in the fourth month, no trace is left. Set retention to how long your team takes to notice things; it can be indefinite.

The location. By default it is stored in the WordPress database. A log that lives only on the site shares its fate: if the site goes down or someone with full access wipes it, the history goes with it. That is what external mirroring is for.

It neither undoes nor blocks. It tells you what changed and who did it, but going back depends on a backup, and stopping attacks is the job of a security plugin.

Getting WP Activity Log running: requirements and first steps

WordPress 5.5 or later and PHP 7.4 or later. It works on multisite and records what happens across the network.

1. Install, activate and set a realistic retention period in the wizard.
2. Decide who can see the log, which can be limited by user or role.
3. Turn on alerts only for what matters, such as role changes or deactivated plugins.
4. If the history matters to you, set up external mirroring.

Other tools in the catalogue to look after the site

If you prefer a single piece, Security Ninja PRO combines an activity log, a cloud firewall, login protection and a scanner. For the way back that the log does not give you, UpdraftPlus makes incremental backups, supports several destinations and restores just part of the site.

To fine-tune what each role sees, User Role Editor Pro lets you, among other things, block admin menu items per role. And with many sites on MainWP, MainWP Pro Reports turns each site's activity into PDF client reports.

Questions about WP Activity Log Pro

What changes compared with the free version?

The free version records the same events. Premium adds search and filters, reports, alerts, session management, an external database, mirroring, archiving and full multisite support.

Does it record WooCommerce orders?

Yes: shop settings, orders, products and coupons.

How long does it keep the log?

Three months by default. The period is changed in the wizard or the settings, and it can be indefinite.

Does it slow the site down?

It is designed not to and every version is tested before release, although the server needs resources in line with the site's load.