Activity Log – Monitor User and Agent Changes

Requires PHP 7.4 for list management functionality.

This plugin is released under a GPL license.

No. Activity Log stores every event in its own dedicated database table instead of mixing into WordPress' core tables, so logging has minimal impact on your site's performance, even under heavy traffic.

You can easily export logs with Activity Log. We also support exporting filtered results. Filter by the time the action took place, roles, users, options, action type, and more.

Yes. Each log entry records its Request Source, so you can tell whether a change was made through the WP Admin, the REST API, WP-CLI, WP-Cron, XML-RPC, or the WP Abilities API. If the request was authenticated with an Application Password, its name is shown as well. Use the Source filter on the log screen to narrow results down to a specific channel.

Yes. For settings, posts, users, user roles, comments, plugin versions, themes, WordPress core version, widgets, and terms, Activity Log stores the old and new value of each changed field and shows them in the log entry details. Secret values such as passwords and API keys are redacted, and long values are truncated to keep the log table small.

Yes, if you turn it on in the settings. On WordPress 6.9 or later, Activity Log adds read-only abilities through the WordPress Abilities API, so AI agents can query logs, summarize activity, and detect suspicious events such as repeated failed logins, newly registered administrators, existing users promoted to administrator, and changes to sensitive settings.

By default, logs are kept for 30 days, but you can set your own retention period from the settings page — from a few days to forever. Failed login attempts and email logs can also be kept or discarded independently.

No. If you'd rather not store IP addresses for privacy reasons, set the "Visitor IP Detected" option to "Do not collect IP" and the IP column will be hidden going forward.

Yes. Activity Log fully supports Multisite, logging activity per site and cleaning up its data correctly when a site is removed from the network.

Yes. Products, orders, and customers are tracked right out of the box, since Activity Log records changes across any post type and taxonomy — no extra setup needed.

Yes. Beyond the built-in toggles for failed logins and email logs, developers can hook into the aal_skip_insert_log filter to skip logging for any event on demand.

You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.