Plugixa Activity Log

Something changed on your site and nobody knows who did it. A page is gone, a plugin was switched off, an editor became an administrator. Plugixa Activity Log answers the question in seconds: who, when, from which address, and what the value was before.

Every sign-in, account, role, post, upload, comment, plugin and setting change is written to a log that cannot be edited or deleted, then shown in a fast React admin with search as you type, filters you can save, a dashboard, and a live view of events as they arrive.

It is built for real sites: one indexed table instead of thousands of posts, one write per request, monitors that cost nothing when you switch them off, and a free edition that is a complete audit log rather than a trial.

WP 6.5+ PHP 8.2+ Tested up to 7.1 Multisite GDPR-ready

Download Now Documentation Changelog

Trusted by WordPress professionals

Screenshots

See it in action

Features

Everything you need

Find what happened in seconds

A fast log viewer built for the question you actually have: who changed this, and when.

Search as you type

Full-text search across messages, objects and users. Type an address and it matches the IP.
Filters that combine

Severity, date range, user, role, IP address, event and area, all at once.
Event inspector

Open any event to see everything captured, including old and new values.
Live view

New events appear as they happen, without reloading.
Saved views

Keep the filters you use every week, share them with the team, and pick a default.

Every change that matters

Each monitor watches one area of the site and writes plain-language events with who, when and where.

Sign-ins and failed sign-ins

Successful sign-ins, sign-outs, wrong passwords, unknown names and password resets.
Users and roles

New accounts, deletions, role changes, email and password changes, application passwords.
Posts, pages and media

Published, edited, trashed, restored and deleted content, with the fields that changed.
Comments, menus and terms

Moderation decisions, menu and widget changes, categories and tags.
Plugins, themes and updates

Installs, activations, deactivations, deletions and WordPress core updates.
Site settings

Changes to WordPress options, with secrets masked before anything is stored.

Record what you need, and nothing else

Decide area by area and event by event what belongs in your log.

Monitors you can switch off

A monitor that is off attaches no hooks at all and keeps what it already recorded.
Single events on or off

Keep an area but drop the one event that is only noise on your site.
Exclusions

Leave out chosen users, roles, IP addresses or ranges, and post types.
PHP error and 404 monitors

Two optional monitors for problems on the site itself, off until you want them.
Flood protection

A burst of failed sign-ins from one address becomes one event instead of thousands of rows.

Know before someone tells you

Be told about the events that matter, where your team already works.

Email notifications

An email for every high or critical event, to the addresses you choose.
Digests and an hourly cap

Group notifications into one message, and never receive more than you set per hour.
Alert rules Pro

Match by event, area, severity, role, user, address or text, and send only those.
Slack, Discord and Microsoft Teams Pro

Post alerts to a channel with the address the service gives you.
Signed webhooks Pro

Send alerts to your own endpoint, signed with a secret so you can verify the sender.

The numbers, on screen and in your inbox

From a quick look at today to a monthly report for a client.

Dashboard

Events per day, severity, most active users and addresses, and recent high-severity events.
WordPress dashboard panel

Recent activity on the WordPress dashboard, without opening the log.
Reports on demand Pro

Choose a period, filters and sections, and download the report as CSV or HTML.
Scheduled reports Pro

Daily, weekly or monthly reports emailed to the people who need them.
CSV export Pro

Export exactly what your current filters show, ready for a spreadsheet.

More than a record of the past

Tools that act on what the log sees.

A log nobody can edit

No screen and no API route changes or deletes an event.
Session management Pro

See who is signed in right now and end any session with one click.
Session limits and idle sign-out Pro

Limit concurrent sessions per person and sign out sessions left idle.
File integrity scan Pro

Find files that changed, appeared or disappeared in core, plugins, themes and uploads.
IP location Pro

Country, region and city for each address, looked up on your own server.

Keep it as long as you need, wherever you need

A log that stays fast at a million events and can be copied off the site.

Built for large logs

Typed, indexed columns and keyset pagination keep the last page as fast as the first.
Retention

Keep events for a number of days, up to a number of events, or both.
Log archive Pro

Move old events out of the live log and still browse them from the same screen.
Archive to another database Pro

Keep the archive in an external MySQL database, away from the site.
Log mirrors Pro

Copy every event to a syslog server, an HTTPS endpoint or a file, with retries.

Monitors for the plugins you run

Each integration records what its plugin does in plain language, and does nothing when that plugin is not active.

WooCommerce Pro

Products, prices, stock, orders and store settings.
SEO plugins Pro

Yoast SEO, Rank Math and Redirection: titles, indexing, redirects and settings.
Forms Pro

Gravity Forms and WPForms: forms created, changed and deleted.
Membership and learning Pro

MemberPress, Paid Memberships Pro, LearnDash and bbPress.
Fields, tables and two-factor Pro

Advanced Custom Fields, TablePress and WP 2FA.

An audit log that respects the people in it

Keep what you need for security and nothing you do not.

Personal data export and erasure

Works with WordPress's own privacy tools to export or anonymise one person's events.
IP address storage

Store addresses in full, truncated, or not at all.
Secrets stay out

Passwords, tokens and keys are masked before anything is stored.
Your data stays on your site

The free edition makes no outbound connection of its own.
Kept when you uninstall

Deleting the plugin keeps the log unless you deliberately switch erasing on.

Scriptable from end to end

Everything the admin can do with the log, your tools can do too.

REST API

Read events, statistics and settings with Application Passwords.
WP-CLI

List, tail and prune events, switch monitors, and change settings from the command line.
Hooks

Actions and filters to enrich events, veto them, or react when they are written.
Health screen

Table size, scheduled jobs and checks, also reported in WordPress Site Health.
WP Activity Log importer

Bring your existing history with you, with a dry run first.
Multisite

One network-wide log, where site administrators see only their own site.

Simple pricing

Choose your growth plan

Start building with Plugixa Activity Log today. Upgrade anytime as your needs grow.

Free

€ 0

Free forever

A complete activity log for any WordPress site.

Searchable log with filters, live view and event inspector
Monitors for sign-ins, users, content, media, comments, plugins, themes and settings
Dashboard and saved views
Email notifications for high-severity events
Retention, exclusions and privacy tools
WP-CLI, REST API and WP Activity Log importer

Start with Free

Pro

€ 39

1-Year License

Alerts, reports, session control and monitors for the plugins you run.

Everything in Free
Alert rules to email, Slack, Discord, Microsoft Teams and signed webhooks
Reports on demand and on a schedule
CSV export of any filtered view
Session management with concurrent-session limits and idle sign-out
File integrity scan for WordPress core, plugins, themes and uploads
IP location from a local MaxMind database
Log archive, in a local table or an external MySQL database
Log mirrors to syslog, an HTTPS endpoint or a file
Monitors for WooCommerce and twelve other popular plugins
Priority email support and one year of updates

License

Instant Digital Delivery

Download immediately after checkout

Secure Payment

Encrypted, PCI-compliant checkout

Auto-Updates

One-click updates from WordPress admin

Trusted by Pros

Used on thousands of WordPress sites

FAQ

Frequently asked questions

Getting Started

Sign-ins and failed sign-ins, new accounts, role and password changes, posts and pages that are published, edited, trashed or deleted, uploads, comments and how they were moderated, menus, widgets and terms, plugins and themes that are installed, activated or updated, and changes to site settings. Each event keeps who did it, their role, when, from which IP address, and what changed.

Install and activate it like any plugin, then open Plugixa Activity Log in the admin menu. Recording starts the moment the plugin is activated, with nothing to configure first. It needs WordPress 6.5 or later and PHP 8.2 or later.

Events are collected during a request and written once, at the very end, in a single query. Each monitor you switch off removes its WordPress hooks completely, so an area you do not care about costs nothing.

Yes. The importer reads the history of WP Activity Log and converts it into this log, with a dry run first so you can see what would be imported. Imported events are put in time order with the events already recorded.

The Log

No. There is no screen and no REST route that changes or removes an event. Events leave the log only through the retention you set, and the one change ever made to a stored event is anonymising a person’s details when you process an erasure request through WordPress’s own privacy tools.

Administrators can see and manage everything. You can give other roles read-only access in Settings, Access. Those roles can read events and the dashboard but cannot change settings or switch monitors.

For 90 days by default. You can keep events for a number of days, up to a number of events, or both. Old events are removed once a day in small batches, and every clean-up is itself recorded.

Each failed sign-in is recorded with the name that was typed and the address it came from. After 30 failures from one address within 10 minutes the plugin records a single high-severity “flood” event and stops adding rows for that address, so an attack cannot fill your database.

Privacy and Data

In its own table in your WordPress database. The free edition makes no outbound connection of its own, and your log is never sent anywhere unless you set up a Pro alert, mirror or scheduled report that sends it to a destination you chose.

The plugin registers with WordPress’s Export Personal Data and Erase Personal Data tools, so a person’s events can be exported or anonymised on request. You can also store IP addresses in full, truncated, or not at all, and choose whether the browser’s user agent is kept.

No. The log is kept unless you first switch on the setting that erases everything when the plugin is deleted. With that setting on, the tables, settings and cached data are all removed.

Pricing and Pro

No. The free edition is a complete activity log with the log viewer, dashboard, core monitors, saved views, email notifications, retention, privacy tools, WP-CLI and the REST API. Nothing in it expires or is locked.

Alert rules that send to email, Slack, Discord, Microsoft Teams or a signed webhook, reports on demand and on a schedule, CSV export, session management, IP location, a file integrity scan, a log archive, log mirrors, and monitors for WooCommerce and twelve other popular plugins.

WooCommerce, Yoast SEO, Rank Math, Redirection, Gravity Forms, WPForms, Advanced Custom Fields, bbPress, LearnDash, MemberPress, Paid Memberships Pro, TablePress and WP 2FA. A monitor whose plugin is not active does nothing and records nothing.