How to track user activity in WordPress with an audit log

What is a WordPress audit log?

A WordPress audit log, also called an activity log or audit trail, is a list of events on a site. Each entry says who did something, what they did, where, when and with what result. It answers the questions that come up after something goes wrong: who deactivated the form plugin, when the new administrator appeared, whether anyone touched the site over the weekend.

A security audit log is the same thing seen from a security angle. It focuses on events that can signal an attack, such as failed logins, new administrators and changed files. In practice, one good WordPress user activity log covers both jobs.

Does WordPress keep an activity log on its own?

Only in small pieces. Out of the box, WordPress records:

• Post revisions. Each saved draft or update of a post or page is stored with its author and date, so you can compare versions and restore an older one.
• The last editor. WordPress stores who last modified each post.
• Active login sessions. For each session that is still open, WordPress keeps the login time, IP address and browser. The record goes away when the session ends.

It does not record failed logins, plugin or theme installs and deactivations, setting changes, role changes, deleted users or past sign-ins. Your host's server logs will not fill the gap either: WordPress's own hardening guide notes that server logs do not show which logged-in user made a request. To track user activity properly, you need an audit log plugin or a platform that does it for you.

What a WordPress user activity log should record

You do not need every event. You need the ones that explain breakage and the ones that signal an attack.

Anatomy of a useful audit log entry

An entry is only useful if it answers five questions without anyone having to guess, as in the example at the top of this page:

• Who: the user account and its role, not just "admin".
• What: the action and the object, with versions where they matter: "Deactivated WP Mail SMTP 4.1.1".
• Where: the site, the screen or source, and the IP address.
• When: an exact time with its time zone.
• Result: whether it worked, and what it changed.

This is also why shared logins are a problem. If five people use the same administrator account, the log can only ever say "admin did it". Give each person their own account with the right WordPress user role, and the log starts to mean something.

How to add an audit log to WordPress

For a single site, an audit log plugin is the quickest route. These are the main options, compared on facts from each tool's own pages.

Whichever you choose, set it up in this order:

1. Pick a tool that fits the job. For one site, a plugin such as WP Activity Log, Simple History or Stream. For many sites, a platform that logs every site in one place.
2. Install it and confirm it is recording. Log out and back in, then check that the login appears in the log.
3. Choose what to record. Keep logins, user and role changes, plugin, theme and core changes and settings on. Add content and store events if you need them.
4. Set a retention period. Ninety days is a sensible minimum; keep 12 months if you handle payments or work under a contract that asks for it.
5. Turn on alerts for the events that matter. New administrators, failed logins in bulk and deactivated security plugins deserve an email, not a weekly glance.
6. Keep a copy off the site. Send the log to an external store or a service that keeps it where a site administrator cannot change it.
7. Read it on a schedule. Spend five minutes a week on it. A log nobody reads is only useful after the damage is done.

How long should you keep WordPress audit logs?

Long enough to investigate problems that are found late, and no longer than you need. Two rules shape the answer:

• Privacy law. Logs hold usernames, emails and IP addresses. The EU's top court ruled in the Breyer case that a dynamic IP address can be personal data for a website operator, and the GDPR names IP addresses as online identifiers. Its storage limitation principle says personal data should be kept no longer than necessary. Mention the log in your privacy policy and delete old entries on a schedule.
• Payment rules. If a site is in scope for PCI DSS, requirement 10.5.1 asks for at least 12 months of audit log history, with the most recent three months available immediately.

For most business sites, 90 days is a sensible minimum and 12 months is enough. Some plugins default to much less: Simple History keeps 30 days unless you change it.

Keep the log where an attacker cannot edit it

Most audit log plugins store the log in the WordPress database. That is convenient, but it means anyone who gets administrator or database access can change or delete the record of what they did. The OWASP Logging Cheat Sheet recommends a central log store, copies on read-only media and tamper detection for exactly this reason, and PCI DSS asks for logs to be protected from changes and backed up to a central server.

In WordPress terms, that means one of three things: a plugin that mirrors the log to an external database or log service, a security plugin that stores events off the site (as Wordfence's audit log does on premium licenses), or a management platform that keeps the log on its own infrastructure.

How to use an audit log when something breaks

A typical case: a client says the contact form stopped sending emails sometime last week. Without a log, you check the form, the mail settings and the host, and you guess. With a log, you filter by the last seven days and see the entry in the example above: an Editor deactivated the SMTP plugin on Tuesday morning. The fix takes a minute and the conversation with the client takes two.

The same filter answers other common questions. A new administrator appeared overnight? The log shows how it was created. A page lost a section? The revision history and the log together show who edited it, and a recent backup gets it back. If the answer points to a break-in, follow our steps for a hacked WordPress site.

Tracking user activity across many WordPress sites

An audit log plugin works one site at a time: one plugin to install, configure and update per site, and one more screen to check. With twenty or fifty sites, the log that would have explained the problem is on the one site nobody looked at.

WPCentrify takes a different approach. (Disclosure: WPCentrify is our product.) Its WordPress activity log keeps one timeline for every site you connect, as part of a WordPress website management platform that also runs updates, backups, uptime and security checks.

To be clear about the limits: the platform log records what WPCentrify does and the significant changes made on each site, not every keystroke in the post editor. If you need a full per-site record of content edits, pair it with revisions or a per-site plugin. For suspicious sign-ins, new and hidden administrators and changed files, Sentinel security monitoring watches every site and emails you when something needs a person.

Sources

• Revisions, WordPress.org documentation, and WP_Session_Tokens, WordPress developer reference
• Hardening WordPress, WordPress Advanced Administration Handbook
• WP Activity Log, Simple History, Stream and Wordfence on WordPress.org
• Court of Justice of the EU, Breyer (C-582/14) press release and the GDPR text (Recital 30, Article 5(1)(e))
• Logging Cheat Sheet, OWASP
• PCI DSS v4.0.1, requirements 10.3 and 10.5.1, as summarized by Microsoft Learn

All sources checked on 10 October 2026.