Activity Log

When something goes wrong on your site — content deleted, settings changed, unauthorized access — the first question is always “who did that and when?” Without an activity log, you’re flying blind. This module records every significant action so you always have answers.

Use Cases#

• Investigate security incidents by reviewing who logged in and from where
• Track which editor published, modified, or deleted content
• Monitor plugin and theme changes for unauthorized modifications
• Meet compliance requirements (GDPR, SOC2) with audit trails
• Hold team members accountable on multi-author sites

How It Works#

The module automatically tracks actions as they happen:

1. User performs an action (login, edit post, activate plugin, etc.)
2. Module captures the action, user, timestamp, and IP address
3. Data is stored in a dedicated database table
4. View logs directly in Switchboard settings
5. Old logs are automatically cleaned up based on retention setting

What Gets Tracked#

Viewing the Log#

Navigate to Tools → Activity Log or access the log through the module’s settings panel. The log displays:

The log shows the most recent 100 entries, sorted newest first.

Settings#

Understanding the Log Entries#

Authentication Events#

• user_login — Successful login
• user_logout — User logged out
• login_failed — Failed login attempt (shows attempted username)

Content Events#

• post_created — New post/page started
• post_published — Content published
• post_draft — Content saved as draft
• post_deleted — Content permanently deleted

Plugin Events#

• plugin_activated — Plugin turned on
• plugin_deactivated — Plugin turned off

User Events#

• user_registered — New account created
• user_deleted — Account removed
• profile_updated — User profile changed

Settings Events#

• option_updated — Core settings changed (tracks: site name, description, URL, home, admin email)

Security Investigation Example#

Scenario: You notice your site’s tagline was changed overnight.

1. Open the Activity Log
2. Look for option_updated actions
3. Find the entry for “blogdescription”
4. Check the user, time, and IP address
5. Cross-reference with login events from the same time

Now you know exactly who made the change, when, and from where.

Data Storage#

Activity logs are stored in a custom database table: wp_switchboard_activity_log

The table includes:

• User ID and username
• User role at time of action
• Action type
• Object type and name (what was affected)
• IP address
• User agent (browser info)
• Timestamp

A daily cron job automatically cleans up logs older than your retention setting.

FAQ#