WPZOOM User History - Activity Log, Lock Users & Change Usernames

Go to Users > All Users, click on any user to edit their profile, and scroll down to the "Account History" section.

On the user edit page, click the "Change" link next to the username field. Enter the new username and click "Change" to save.

No. The plugin only logs that a password was changed, along with the date and who changed it. No password values (hashed or otherwise) are ever stored.

Yes! On the All Users page, use the search box to search for any previous email, username, or name. Users who previously had matching values will appear in the results.

• Username (user_login)
• Email (user_email)
• Password (change event only)
• Display Name
• Nicename
• Website URL
• First Name
• Last Name
• Nickname
• Biographical Info
• Role (including multiple roles with Members plugin)

Yes. The plugin works on multisite installations and properly handles super admin username changes.

Yes. The plugin correctly tracks role changes when using the Members plugin, which allows assigning multiple roles to users.

There are several ways to lock a user:

1. User edit page - Go to a user's profile and click "Lock Account" in the Account Status section
2. Row action - Hover over a user on the All Users page and click "Lock"
3. Bulk action - Select multiple users on the All Users page, choose "Lock" from the Bulk Actions dropdown, and click Apply

• All active sessions are destroyed immediately
• The user cannot log in via the login form
• Application password authentication (REST API, XML-RPC) is blocked
• A customizable error message is shown on the login screen
• WP-CLI access is still allowed so admins can manage the account

Go to User History > Lock Accounts. You can set a custom message that locked users will see when they try to log in. Leave it empty to use the default message.

On the user edit page, scroll down to the Account History section and click the "Clear Log" button. To clear all logs for every user at once, go to User History > Settings and click "Clear All Logs".

Go to User History > Settings. Under "Data Retention", set the number of days to keep logs (default: 30). Old logs are automatically deleted daily. Set to 0 to keep logs indefinitely.

Yes! The Account History section on each user's edit page has a "Logins" tab that shows all login events, logouts, and failed login attempts with timestamps, IP addresses, and browser information.

On the user edit page, scroll down to Account History and click the "Sessions" tab. You can see all active sessions including login time, IP address, browser, and when each session expires. Click "Log Out Everywhere" to destroy all sessions.

Yes. Go to User History > Settings and uncheck "Record IP addresses" under the Privacy section. This helps with GDPR compliance.

Yes. When you activate User History, any users locked with the Lock User Account plugin will be automatically migrated to the new lock system.

Go to User History > Dashboard Access. Enable "Restrict Dashboard Access", choose which users keep access (by role preset or a specific capability), and set the redirect URL for everyone else. You can optionally keep profile pages accessible, show a message on the login screen, and allowlist specific admin URLs.

Yes. If the Remove Dashboard Access plugin is active when you update, its settings are imported automatically and the restriction stays enabled — you can then deactivate the old plugin. If the old plugin was already deactivated, the settings are still imported but the restriction stays off until you enable it.

Go to User History > Username Restrictions and enable "Restrict Usernames". You can block exact usernames, block text fragments anywhere in a username, require a prefix/suffix/substring, set a minimum and maximum length, and disallow spaces. Use the "Test Usernames" tool at the bottom of the page to see how your saved rules evaluate sample usernames.

Existing accounts are never affected — only new registrations are checked. By default, users who can create accounts (administrators) bypass the rules when adding users in wp-admin or changing usernames; enable "Also apply the rules to usernames chosen by administrators" under Advanced to enforce them there too.

Go to User History > Activity Log to see a chronological list of actions performed on your site: content changes, uploads, comments, user management, logins, plugin/theme/core changes and settings changes. Each entry shows the date, the user (with avatar), the event, a description linking to the affected item where possible, and the IP address (if IP tracking is enabled). Use the dropdowns to filter by user, event group or specific event, or search by name/IP.

Yes. Go to User History > Settings, scroll to "Activity Log", and untick the event groups you don't need — or untick "Enable the activity log" to stop recording entirely. Activity entries follow the same retention period as user history logs.

It's a deliberately lightweight alternative: a single table, no external services, no dashboards or alerts. It covers the events most sites care about. Developers can record their own events with WPZOOM_User_History::get_instance()->activity_log->log( $action, $object_type, $object_id, $object_name, $context ) and describe them via the wpzoom_user_history_activity_log_description filter.

Yes. If the Restrict Usernames plugin is active when you update, its settings are imported automatically and the restriction stays enabled — you can then deactivate the old plugin. If the old plugin was already deactivated, the settings are still imported but the restriction stays off until you enable it. Code using the c2c_restrict_usernames-validate filter can switch to wpzoom_user_history_validate_username, which takes the same arguments.