Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail

Dragon Activity Log records what happens on your WordPress site in a fast, searchable audit trail that lives in its own database table. Unlike a plain event list, it shows the field-level change for the fields listed below (the old role and the new role, the old setting value and the new one, a renamed title or slug), and it links every event to the one before it with a SHA-256 hash so that a later edit or deletion of the log can be detected.

Everything in this plugin is free and fully functional: every event type, no cap on the number of events stored, any retention window including “keep forever”, all filters and search, live updates, integrity verification, one-click rollback of settings and role changes, full before/after diffs, security alert emails, CSV and JSON export, WooCommerce events, and the WP-CLI commands. (Individual values in the change detail of a log row are shortened at 500 characters; the full diff keeps the whole value.)

Why Dragon Activity Log

• Field-level change detail – before and after values for post title, slug and excerpt, user email, display name, URL and roles, media title, caption and alt text, and single-value settings (array settings show their item count, and a post body is flagged as changed in the row)
• Full before/after diffs – “Full details” on a post or setting event opens a side-by-side diff of the whole post content, title, excerpt and status, or of the whole setting value, kept from the moment of the change
• One-click rollback – put a changed setting back to its previous value, or undo a role change, from the same dialog. A rollback only runs while the setting or the user’s roles still hold exactly what the event left behind, follows WordPress’s own rules for who may change roles, and is itself recorded in the chained log
• Security alerts by email – a login from an IP address the user has not used before, a burst of failed logins from one address, and a user made administrator (or super admin on a network), sent to the site admin email or a list of addresses you choose. Off until you switch them on
• CSV and JSON export – download the events that match the filters on screen; spreadsheet formulas in exported cells are neutralised, and every export is itself logged
• WooCommerce events – new orders, order status changes, stock quantity and stock status changes, and new coupons, recorded while WooCommerce is active
• Tamper-evident hash chain – every event is chained to the previous one; one click checks the chain (up to 25 seconds in the browser; the WP-CLI command checks a log of any size end to end) and reports the first event whose link no longer matches
• Off-site anchor – email (and optionally post to a signed webhook) the chain head daily or weekly, then compare the log against any anchor later: proof that the log was not rewritten, even by someone with database access
• Site Health – an integrity test and an anchor test on the Site Health screen, plus a debug-information section
• Fast and lean – events live in their own indexed table, never in your posts table, and are pruned automatically on the retention window you choose
• Live activity stream – new activity appears on the log screen as it happens
• Privacy controls – capture, anonymize or skip IP addresses, and exclude trusted roles from logging
• Privacy tools integration – events caused by a user, events about their account, failed logins against their username or email, and events about comments they wrote (guests included) are covered by WordPress personal data export and erasure requests
• WP-CLI – wp dragon-activity-log list, prune, anchor and verify

What gets logged

• Logins – successful logins, logouts, failed logins, password resets
• Users – registration, profile changes, role changes, deletion, and on multisite removal from a site and super admin grants and revocations
• Content – posts, pages and custom post types: create, edit, status change, trash, restore, delete
• Plugins and themes – activate, deactivate, install, update (and a failed single update), delete, switch
• Settings – WordPress and plugin option changes and deletions, with secret-shaped values redacted (option writes made by background cron tasks are skipped unless they touch core settings)
• Media – uploads, title, caption and alt text edits, deletions
• Taxonomies – term create, edit and delete for categories, tags, menus and custom taxonomies
• Comments – submitted, approved, unapproved, spam, trashed, deleted
• Core – WordPress core updates and content exports
• WooCommerce (while it is active) – new orders, order status changes, product stock quantity and stock status changes, new coupons. Orders are no longer also logged as posts on stores that keep orders in the posts table, and a new coupon is logged once as a coupon (its later edits as post events). Store events recorded with no logged-in user (a guest checkout, a payment gateway callback or a scheduled task) keep no IP address
• The log itself – clearing, retention cleanup, anchors, exports, rollbacks and failed alert deliveries

WP-CLI

• wp dragon-activity-log list [--limit=<n>] [--event=<code>]
• wp dragon-activity-log prune
• wp dragon-activity-log anchor – send an off-site anchor now
• wp dragon-activity-log verify [--anchor=<reference>]

External services

This plugin does not connect to any external service of ours or of any third party. All logging, hashing and verification runs on your own server.

The optional off-site anchor sends the chain head (an event number, a hash, your site URL and a timestamp; never any event data) to a destination you configure: by email through your site’s normal mail delivery, and, only if you enter a webhook URL, by an HTTPS POST to that URL. Nothing is sent unless you turn the anchor on.

The optional security alerts send an email through your site’s normal mail delivery to the site admin email or the addresses you list. An alert names the site, the user concerned, the acting user or the attempted username, and the IP addresses involved (a burst alert can list several), and links to the activity log. Nothing is sent unless you turn the alerts on.

Credits

The WordPress.org listing icon is drawn with glyphs from Lucide (https://lucide.dev), ISC License. Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather (https://feathericons.com, MIT License). All other copyright (c) for Lucide are held by Lucide Contributors 2022. The plugin itself does not include these icons.

Privacy Policy

Dragon Activity Log stores activity data locally in your WordPress database, including usernames, IP addresses (unless disabled or anonymized), and details of changes made on your site. It does not send any data to third parties. IP capture can be disabled or anonymized in the settings. WooCommerce events recorded with no logged-in user (a guest checkout, a payment gateway callback or a scheduled task) are stored without an IP address, because they cannot be matched to a person’s email address. WordPress personal data export and erasure requests are matched by email address and cover events caused by the user, events about their account, failed logins against their username or email, and events about comments written with that email (so guest commenters are covered too). Events about comments that have since been deleted can no longer be matched to an email address.