What the WordPress activity log records
The log is pared down to events that matter for security, rather than every page view or autosave. It records:
- sign-ins, failed sign-ins, sign-outs, password reset requests and completed resets;
- users created or deleted, role changes and profile updates;
- plugins activated or deactivated, theme switches, installs and updates;
- posts published or moved to the trash, and media added or deleted;
- changes to key site settings such as the admin email, site address, default role and whether anyone can register;
- changes to WP SecureGate's own settings;
- security events: lockouts, two-factor sign-ins, scan findings and blocked WooCommerce payments.
On by default, kept for 90 days.
A WordPress audit log you can verify
An ordinary log is only as trustworthy as the database it sits in. Anyone who gets admin or database access can quietly remove the lines that show what they did.
This log is append-only. Each entry carries an HMAC-SHA256 hash of its contents and the entry before it, keyed with a secret unique to your site. Change one entry, or delete it, and the chain no longer adds up. Running verification walks the chain and reports the first entry that was altered or removed. It can't stop someone with database access from deleting rows, but it makes sure you'll know they did.
On with the activity log. You run verification whenever you want to check.
The email log
A separate log records every email WordPress sends, whether it was sent or failed, with a preview. It answers questions like whether a password reset really went out, or whether your site sent mail you didn't expect. Message bodies can include one-time reset links, so only admins can view it, and a metadata-only mode keeps the record without the contents.
On by default, kept for 30 days.
Admin-account watch
Someone with database access can add an administrator without going through WordPress at all, by writing rows straight into the users tables. No WordPress hook fires, so a normal user log never sees it. The admin-account watch keeps track of administrators created the proper way and raises an alert for any administrator that appeared some other way.
On its first check it treats your current administrators as the starting point, because there's no way to tell after the fact how an older account was made.
On by default. Alerts reach your inbox only if email alerts are switched on.
WordPress security log alerts for settings changes
If you switch email alerts on, the plugin emails you about the settings changes worth a second look: protection being weakened, a change made while nobody was signed in, or a change made by an administrator who isn't an owner. Each email shows who made the change, their IP address, location, network, device, browser and operating system.
Alerts and the wider dashboard are covered on security monitoring.
Off until you switch email alerts on.
Using the log after an incident
When a scan finds malware, the activity log helps you work out what happened. Verify the chain first, so you know the record is intact.
What you find tells you which accounts to reset, which plugins to remove and roughly when the break-in started, which helps you pick a clean backup. The repair steps are on WordPress malware removal. Start by reading back from the date of the first finding:
- sign-ins from unfamiliar addresses or at odd hours;
- new administrator accounts or role changes;
- plugins installed or activated that nobody on your team recognises;
- a changed site address or admin email.
Part of WP SecureGate: Monitoring and alerts →