حياة هوست - استضافة مواقع وحجز نطاقات
Open a Ticket

Hyyat Host Help Center

View Categories

The WordPress Activity Log: How to See Who Changed What on Your Site, and When

2 min read

0:00 3:23
In shortWordPress does not keep a clear record of what happens in the dashboard on its own. An activity log plugin writes down every important event: who logged in and from where, who edited a page, who installed a plugin or created a user. That record answers “what happened?” when the site breaks, and reveals a hack early when a login or change appears that nobody on your team made.
WordPress activity log: a list of timed events and a magnifying glass

Imagine opening your site one morning to find the home page changed, an unknown plugin, or a new Administrator. The first question is: who did this, and when? Without an activity log the answer is a guess. With one, you find the line you need in a minute.

What does an activity log record? #

1LoginsEvery successful or failed login, with the username, IP address and time.
2ContentCreating, editing and deleting posts, pages and menus.
3Plugins and themesInstalls, activations, deactivations, updates and deletions.
4UsersNew users, role changes and password changes.
5SettingsChanges to the site address, admin email or registration settings.

How to start #

  1. Install a trusted activity log plugin: Such as WP Activity Log or Simple History from the official WordPress directory. Read how to choose a safe plugin.
  2. Set the retention period: Two to three months is enough for most sites. A very long log enlarges the database.
  3. Enable alerts for critical events if available: Such as a new Administrator, a plugin install, or a login from an unusual country.
  4. Review the log weekly: Five minutes a week is enough to spot anything strange.

What should catch your eye? #

  • A successful login at a time nobody works, or from a country where your team is not.
  • A new Administrator nobody on your team created.
  • A plugin installed or theme files edited without a request.
  • Many failed logins on one account.
  • A change to the site’s admin email.
Example: The log shows user “sara” logged in at 3 a.m. from an address outside your region, then installed a plugin with an odd name. Sara was not working at that time. Her password was stolen: change it at once, remove the plugin, and follow the malware removal steps.

WordPress log versus server logs #

An activity log only sees what happens inside WordPress. Requests that never reached the dashboard, such as exploit attempts, appear in the server logs. In cPanel you will find the visitor and error logs. Read viewing visitor logs.

Mind privacy: the log stores IP addresses and usernames. Give access to Administrators only, and mention it in your privacy policy if your site collects visitor data.

How Hyyat Host helps #

  • Visitor and error logs are always available to you in cPanel.
  • If you suspect a hack, open a ticket and we will help you read the server logs and find the way in.
  • Brute force protection and Imunify360 block addresses attacking the login page.

Learn more about our log analysis service.

Frequently asked questions #

Does an activity log slow my site?

Well-known plugins are light. What matters is a sensible retention period so the database does not grow too large.

Does WordPress log logins without a plugin?

WordPress does not keep a detailed record of logins and changes on its own, so you need a plugin.

What if I find a login I do not recognise?

Change that account’s password right away, sign out all sessions, review what changed after the login, and scan your files.

Related guides

All website security guides →

What are your Feelings
A Hyyat Host customer?Log in to the client area and open a ticket, mentioning this guide and what you tried.Log in and open a ticket
Not a customer yet?Technical support is for Hyyat Host customers. Host your site with us and get support that helps with issues like this.Ask about hosting on WhatsApp
Contact us on WhatsApp