DevDome Activity Log is a free activity tracker that keeps an audit trail of recorded site changes. Review account activity, content edits and settings changes with filters, search and CSV export. Everything is stored locally in your site's own database, with no DevDome account needed.
Free and GPL licensed, reviewed by the WordPress.org plugin team.
Use a local user activity log to follow the changes covered below. Choose what to record, control access and review events in your WordPress dashboard.
Track logins, logouts, failed attempts, password resets, account creation and deletion, role changes and profile edits. Repeated failed logins and reset requests share an hourly row per source and attempted account. Email changes are masked; passwords are never recorded.
Record creation, updates, trashing, restoration and deletion of posts, pages and custom post types, with a change summary. Content bodies are compared by hash and never stored. Media uploads and deletions and comment status changes are also recorded.
Track plugin and theme installs, updates, activations, deactivations and deletions, theme switches and core updates. Previous and new versions are included when observable. Updates with an unchanged installed plugin or theme version are recorded as failed.
The activity tracker records changes to site title, site URL, home URL, admin email, open registration, default role, permalink structure, site time zone and UTC offset. Other site options are outside this fixed list.
Record policy changes with previous and new values, CSV exports, retention purges, personal-data erasures and storage migrations. These records cannot be switched off by the settings they describe. Failed writes and storage problems appear as errors, not an empty healthy log.
Filter by user, activity group, action, object type, severity and date range, or search objects, details and usernames. Export the filtered view to CSV with spreadsheet formulas neutralised. The Overview shows recent activity and events worth reviewing.
Seven separate capabilities cover reading, exporting, policy changes, purging, diagnostics, storage repair and full IP viewing. Administrators receive all seven. IP truncation is on by default, credentials are redacted and emails masked. Retention runs from 1 to 3650 days, default 90.
On WordPress 6.9 and newer, eleven abilities expose activity, settings, purge and storage repair through the WordPress Abilities API. MCP access needs the WordPress MCP Adapter. Permissions still apply; reducing coverage, purging or repairing storage requires explicit confirmation.
Recording starts as soon as you activate the plugin. Open the log to review recorded activity and choose the privacy and retention settings for your site.
Install DevDome Activity Log from WordPress.org and activate it. Recording starts immediately with sensible defaults, and no DevDome account is needed.
Open DevDome Tools > Activity Log. Check the Overview, then use the Activity screen to filter recorded events by user, action, severity or date.
Use Settings to choose retention, configure trusted proxies, toggle event groups and exclude roles or users. Protected event groups remain recorded regardless of exclusions.
Every tracker, the dashboard, all filters, retention control and CSV export are free. There is no paid tier or locked feature inside the log. No DevDome account is needed. Everything is stored locally in your site's own database, and the Activity Log's own features make no network requests.
It does not record comment creation, editing or permanent deletion; media edits or file replacements; term, taxonomy, menu, widget, Customizer, block-template or post-meta changes; rolled-back core updates or update failure reasons; application passwords; session destruction; the plugin/theme file editor; capability changes outside roles; network-level multisite actions; WooCommerce or other third-party events; or site options outside the nine-option list.
Yes. A site administrator or anyone with database access can edit or delete rows, and the plugin does not detect that. There is no hash chaining or signed batching. The log is evidence of activity on a site you still control. For evidence that survives a site compromise, copy it somewhere the site cannot write to.
CSV export is synchronous and capped, with no background job, progress or resume; narrow large exports by date. The user filter lists the 200 most recently active accounts. Multisite storage and screens are per site, with no network-wide screen. Multi-million-row queries have not been benchmarked; large free-text searches, deep pagination and single-pass personal-data erasure can be slow.
IP truncation is on by default, but is pseudonymisation, not anonymisation. Credentials are redacted and user-event emails masked. Retention is 1 to 3650 days, default 90. The WordPress personal-data exporter includes account activity; the eraser clears username, user ID, IP, display name and the whole details sentence. It keeps pseudonymised security history and tells the requester why.
No plugin can do that. This plugin stores personal data, including usernames, IP addresses, timestamps and behavioural history. It provides default IP truncation, secret redaction, email masking, capability-scoped access, retention, exclusions and WordPress exporter/eraser integration. Deciding your lawful basis, notice, retention period and security measures remains your responsibility.
By default, the address your server saw on the connection. A forwarded header is trusted only when you configure both its name and your proxies' CIDR ranges in Settings, and the connection came from one of those ranges. Without that check, someone reaching your origin directly could choose the address written into the log.
On WordPress 6.9 and newer, eleven abilities use the WordPress Abilities API; MCP needs the WordPress MCP Adapter. Reads require log-reading permission and are recorded. Settings, purge and repair actions need their own permissions, with confirmation for reduced coverage, purging and repair. No raw email address or server path leaves through an ability. Older WordPress registers none.
Installation, settings, data use and troubleshooting, before you install.
Install DevDome Activity Log from WordPress.org through the Plugins screen, or upload it to /wp-content/plugins/, then activate it.
No DevDome account is needed. Every tracker, the dashboard, filters, retention control and CSV export are free, with no locked features inside the log.
Open DevDome Tools, Activity Log in the admin menu. Recording starts immediately with sensible defaults. Review the Overview and use the Activity screen to filter or search recorded events.
In Settings, choose a retention window from 1 to 3650 days, default 90, toggle event groups and exclude roles or usernames. An account with several roles is excluded if any role is listed. Protected event groups remain recorded.
IP truncation is on by default. If your site uses a proxy, configure both the forwarded header and the trusted proxy CIDR ranges. The header is only trusted when the connection comes from one of those ranges.
Everything recorded by Activity Log is stored locally in a dedicated table in your site's own database. Its own features make no network requests. Records can include account identity, IP addresses, timestamps and activity details. IP truncation is on by default and is pseudonymisation, not anonymisation. Credential-like values are redacted and user-event emails masked. Retention is 1 to 3650 days, default 90, with a daily purge. The WordPress personal-data exporter includes account activity. The eraser clears username, user ID, IP, display name and the whole details sentence, retaining pseudonymised security history and explaining this to the requester. The plugin writes nothing to visitor browsers and adds nothing to your site's front end.
Error reports go to devdome.com only when you press Report this error. They include redacted error text, plugin and platform versions, multisite status, locale, screen, plugin state, site address, generated site ID, connected account ID if present and admin email for a reply. Plugin state excludes event rows, usernames and IP addresses. The plugin catalog is fetched from devdome.com only after connecting an account, at most once every 12 hours, or one hour after a failed fetch. It sends only the bundled core version, with no site or visitor data. The Report a bug link opens your browser with the plugin identifier and version; the plugin itself sends nothing.
Connecting an optional DevDome account sends your site address, generated site ID and secret site token to DevDome. Later account checks send the site address and token, normally at most once every fifteen minutes while a DevDome screen is open. Connecting through the Tools dashboard card that discloses this also shares active DevDome plugin slugs and versions, plus bundled library, WordPress and PHP versions. Other plugins, users, email addresses, content, visitors and activity-log rows are excluded. Connections through buttons without that disclosure do not send the plugin list. Disconnecting stops checks and plugin-list sharing. The WordPress.org edition disables the shared bot-detection feed download and contains no self-hosted updater.
The WordPress.org package updates only from WordPress.org. Activity Log records observed plugin, theme and core updates without changing, delaying, blocking or redirecting them. Storage migration runs on update; review retention and proxy settings in Settings after updating.
Uninstalling the plugin drops its dedicated activity table and every setting it created. Export any activity you want to keep before uninstalling. CSV export is synchronous and capped, so narrow large exports by date range.
An event is missing: check the published coverage list, enabled event groups and role or username exclusions. Events outside that list are not recorded, and protected event groups remain recorded regardless of exclusions.
The recorded IP belongs to your proxy: configure the forwarded header and trusted proxy CIDR ranges in Settings. Without both, the plugin uses the address your server saw on the connection.
Searching or exporting a large log is slow: narrow the date range. Free-text searches over details and deep pagination are expensive. CSV exports are synchronous and capped, with no background job or resume.
The screen reports a storage or query error: use Try Again or review the suite health panel. Missing tables, failed writes, migrations and queries are reported as errors. Storage repair requires its own capability and explicit confirmation.
Still stuck? Ask on the WordPress.org support forum or use the DevDome contact form. For a security problem, use the Report a security issue tab instead.
Read from the WordPress.org release when this site was last synced. The two latest versions are shown here; the full history is on WordPress.org.
Please tell us before telling anyone else, and we will fix it and credit you if you want the credit. Use the contact form and say it is a security report, so it gets read first.
We are a small team, so we will not pretend to a 24/7 security desk or a guaranteed response time. We will read it, reply, and tell you honestly what we are doing about it.
Install DevDome Activity Log from WordPress.org, activate it and open Activity Log. Recording starts immediately, with no DevDome account needed.
