--- title: "The WordPress Activity Log: How to See Who Changed What on Your Site, and When" description: "**In short**WordPress does not keep a clear record of what happens in the dashboard on its own. An activity log plugin writes down every important event: who logged in and from where, who edited a page, who installed a plugin…" url: "https://www.hyyat.com/en/knowledgebase/wordpress-activity-log/" updated: "2026-10-22" category: Website Security --- # The WordPress Activity Log: How to See Who Changed What on Your Site, and When **In short**WordPress does not keep a clear record of what happens in the dashboard on its own. An activity log plugin writes down every important event: who logged in and from where, who edited a page, who installed a plugin or created a user. That record answers “what happened?” when the site breaks, and reveals a hack early when a login or change appears that nobody on your team made. ![WordPress activity log: a list of timed events and a magnifying glass](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-activity-log.webp) Imagine opening your site one morning to find the home page changed, an unknown plugin, or a new Administrator. The first question is: who did this, and when? Without an activity log the answer is a guess. With one, you find the line you need in a minute. ## What does an activity log record? *1***Logins**Every successful or failed login, with the username, IP address and time. *2***Content**Creating, editing and deleting posts, pages and menus. *3***Plugins and themes**Installs, activations, deactivations, updates and deletions. *4***Users**New users, role changes and password changes. *5***Settings**Changes to the site address, admin email or registration settings. ## How to start 1. **Install a trusted activity log plugin:** Such as WP Activity Log or Simple History from the official WordPress directory. Read [how to choose a safe plugin](https://www.hyyat.com/en/knowledgebase/choose-safe-wordpress-plugin/). 2. **Set the retention period:** Two to three months is enough for most sites. A very long log enlarges the database. 3. **Enable alerts for critical events if available:** Such as a new Administrator, a plugin install, or a login from an unusual country. 4. **Review the log weekly:** Five minutes a week is enough to spot anything strange. ## What should catch your eye? - A successful login at a time nobody works, or from a country where your team is not. - A new Administrator nobody on your team created. - A plugin installed or theme files edited without a request. - Many failed logins on one account. - A change to the site’s admin email. **Example:** The log shows user “sara” logged in at 3 a.m. from an address outside your region, then installed a plugin with an odd name. Sara was not working at that time. Her password was stolen: change it at once, remove the plugin, and follow the malware removal steps. ## WordPress log versus server logs An activity log only sees what happens inside WordPress. Requests that never reached the dashboard, such as exploit attempts, appear in the server logs. In cPanel you will find the visitor and error logs. Read [viewing visitor logs](https://www.hyyat.com/en/knowledgebase/view-website-visitor-stats-awstats/). **Mind privacy:** the log stores IP addresses and usernames. Give access to Administrators only, and mention it in your privacy policy if your site collects visitor data. ## How Hyyat Host helps - Visitor and error logs are always available to you in cPanel. - If you suspect a hack, open a ticket and we will help you read the server logs and find the way in. - Brute force protection and **Imunify360** block addresses attacking the login page. Learn more about [our log analysis service](https://www.hyyat.com/en/log-analysis/). ## Frequently asked questions Does an activity log slow my site? Well-known plugins are light. What matters is a sensible retention period so the database does not grow too large. Does WordPress log logins without a plugin? WordPress does not keep a detailed record of logins and changes on its own, so you need a plugin. What if I find a login I do not recognise? Change that account’s password right away, sign out all sessions, review what changed after the login, and scan your files. **Related guides** - [WordPress User Roles and Permissions: Who Needs Administrator Access and Who Does Not](https://www.hyyat.com/en/knowledgebase/wordpress-user-roles/) - [How to Tell if Your Website Is Hacked: 10 Signs and Quick Checks](https://www.hyyat.com/en/knowledgebase/signs-your-website-is-hacked/) - [How to View Website Visitor Statistics with AWStats](https://www.hyyat.com/en/knowledgebase/view-website-visitor-stats-awstats/) - [How to Protect the WordPress Login Page (wp-admin): 7 Practical Steps](https://www.hyyat.com/en/knowledgebase/protect-wordpress-login-wp-admin/) [All website security guides →](https://www.hyyat.com/en/kb/website-protection/) **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[WordPress Hosting](https://www.hyyat.com/en/wordpress-hosting/)[WordPress design](https://www.hyyat.com/en/wordpress/)