Login Intelligence – User Activity & Login History

Login Intelligence helps WordPress administrators understand how users access their websites by providing clear, actionable insights into authentication velocity, account engagement, active sessions, and local security signals.

All functionality runs entirely on your WordPress server using deterministic database queries and transient caching. There is zero third-party cloud tracking, zero external API dependencies, no automated user lockouts, and no paywalls.

Key Features

• Overview Dashboard: Centralized view of authentication velocity, 7-day login volume trends, and user lifecycle distributions.
• Activity History: Complete event stream capturing successful logins, failed attempts, and logouts with pagination and event type filters.
• Security Radar: Rule-based local anomaly detection highlighting failed login surges, concurrent sessions across devices, dormant account reactivations, and new browser contexts.
• User Lifecycle State Engine: Automatically categorizes accounts into Active, Idle, Dormant, and Never Logged In with color-coded badges and native Users list table filter tabs.
• Session Intelligence & Device Context: Inspect active sessions with parsed browser, operating system, and device type without intrusive client-side fingerprinting.
• Synchronized Dual-Write Engine: Fast user metadata caching for immediate administrative sorting paired with a dedicated append-only wp_llid_events database table for historical auditing.
• User Profile Activity Timeline: View individual user authentication history directly on the user profile edit screen with efficient cursor pagination.
• Automated Data Retention: Scheduled daily WP-Cron pruning maintains a lean database footprint according to your configured retention schedule.
• Privacy by Design: On-premise event storage, IP address anonymization options, and full integration with WordPress Core Personal Data Exporter and Eraser tools.
• Multisite Compatible: Works seamlessly on single-site WordPress installations and across WordPress Multisite networks.
• 100% Free: No Pro tiers, paid add-ons, license keys, or upsell notices.

How It Works

1. Authentication Monitoring: When a user attempts to log in or log out, Login Intelligence captures the event via WordPress core authentication hooks (wp_login, wp_login_failed, and clear_auth_cookie).
2. Dual-Write Storage: The plugin updates the user’s metadata summary (last login time, login count, IP, and user agent) for instant sorting in the WordPress Users table, while appending a structured event record to the dedicated wp_llid_events custom table.
3. Local Signal Detection: Security Radar calculates authentication velocity directly from local database queries, comparing recent event frequencies against configurable thresholds (such as 5 failed attempts within 15 minutes or logins from multiple concurrent IPs).
4. Advisory Feedback: Security Radar provides purely observational, advisory signals. It never blocks, throttles, or locks out users automatically, preserving administrative control and preventing accidental lockout of legitimate users.
5. Scheduled Maintenance: A daily WP-Cron event automatically purges activity records older than your configured retention window (default 90 days), ensuring database efficiency over time.

Privacy and Data Retention

Login Intelligence is designed with a strict privacy-first architecture:

• On-Premise Storage: All authentication events, session metadata, and configuration options reside exclusively within your WordPress installation’s MySQL/MariaDB database.
• IP Address Handling: IP addresses are recorded strictly for authentication auditing and local anomaly detection. Administrators can configure IP retention or anonymization according to their site policies.
• WordPress Core Privacy Tools: The plugin fully implements the WordPress Core Personal Data Exporter and Personal Data Eraser APIs. When an administrator fulfills a data export or erasure request, historical login events and metadata associated with that user are included or erased accordingly.
• Automated Data Pruning: An automated daily WP-Cron job prunes historical event records older than the administrator-configured retention period (default 90 days).
• Controlled Uninstall Policy: Plugin data is retained upon uninstallation by default. Site administrators have explicit control via the “Delete all plugin data when uninstalled” setting to remove the custom event table and all plugin options when desired.