WP Activity Log Premium: Trace WordPress Changes

Which WordPress change needs investigating?

WP Activity Log Premium and WP Activity Log Enterprise give administrators and security professionals more ways to review activity across WordPress sites and multisite networks. Events can show when something happened, which visitor and role were involved, the source IP address, and the affected object. For content changes, the log can also show what changed, helping with troubleshooting, user management, accountability, and compliance work.

What can the activity log record?

Tracked events can include changes to posts, pages, custom post types, categories, tags, widgets, menus, user accounts and profiles, WordPress settings, add-ons, themes, files, and database tables. Access events include logins, logouts, failed login attempts, and termination of other sessions. On multisite networks, events can include adding, deleting, or archiving websites, and adding or removing users from sites.

For supported third-party tools, activity may include changes to WooCommerce stores and orders, Advanced Custom Fields, bbPress, Gravity Forms, LearnDash, MemberPress, MainWP, ManageWP, Paid Memberships Pro, and RankMath. The events available depend on the integration.

How can teams review and act on events?

• View logged-in users and their current activity, then log off a user from the activity interface.
• Search and filter the event history to narrow results during an investigation.
• Generate configurable HTML or CSV reports for analysis and record keeping.
• Set email, SMS, or Slack alerts for important changes.
• Add notes to log entries to retain internal context.
• Archive older activity data to another database for storage management.

Where are logs stored?

WP Activity Log stores activity in the WordPress database by default. The Enterprise edition includes the option to save logs to an external database and mirror them in real time to services such as AWS CloudWatch, Loggly, Papertrail, Syslog, or other SIEM systems. Slack can also receive mirrored logs, and logs can be copied to a file on the web server.

How long is activity retained?

Log data can be retained indefinitely. The default retention period is three months; select a retention policy during the initial configuration or change it in the add-on settings.

Set up the activity log

1. Install and activate WP Activity Log.
2. Follow the initial configuration wizard or open the extension settings.
3. Choose a retention policy and review the activity logging options.
4. Configure reports, alerts, session controls, storage, or mirroring according to the selected edition and operational needs.
5. Review the activity log regularly, using filters and reports to investigate changes or document site activity.