Something changed on your site and nobody remembers doing it. Orbilog keeps a plain, readable record so you can find out.
Every entry answers four questions: who did it, what they did, when, and from where.
John Smith (Editor) updated the page “About Us” — 8 September 2026 at 10:30, from 203.0.113.0
What it records
- Logins — successful sign-ins, failed attempts, sign-outs, password changes, password reset requests
- Users — accounts created, edited, deleted, and every role change, with new administrators flagged as critical
- Content — posts, pages, and custom post types created, updated, published, scheduled, trashed, restored, or deleted, including which fields changed
- Media — uploads, edits, attachments, and deletions
- Comments — approvals, edits, spam, trash, and deletions
- Plugins and themes — installs, activations, deactivations, updates, deletions, theme switches, and built-in file-editor changes
- WordPress core — version updates
- Settings — site title, addresses, administration email, registration, default role, permalinks, reading and discussion settings, menus, and widgets
Built to be trustworthy
- Everything stays on your site. No external requests, no telemetry, no account required.
- Passwords are never recorded — not in plain text, not as hashes. Neither are reset links, cookies, tokens, or payment details.
- IP addresses are anonymised by default. 203.0.113.42 is stored as 203.0.113.0. You can switch to full addresses or turn IP recording off completely.
- Logging never breaks your site. If an entry cannot be written, the action still goes through.
- Deletion leaves a trace. Clearing the log is itself recorded, and that record cannot be switched off.
Finding things
Search by user, activity, content title, event ID, or IP address. Filter by date range, user, role, activity type, and severity. Export whatever you are looking at to CSV — with spreadsheet formula injection blocked.
Keeping it tidy
Choose how long to keep entries: 30, 60, 90, 180, or 365 days, or forever. The default is 90 days, and old entries are cleared once a day automatically. You can exclude specific users, roles, or IP addresses from being recorded at all.
Permissions
Four separate permissions — view, export, change settings, and delete — can each be granted per role. Administrators always keep all four. An editor can be given read-only access to the log without gaining anything else.
Privacy
Orbilog registers with the built-in WordPress personal data tools. An export includes a person’s own entries. An erase request keeps the entries as a security record but removes the login name and IP address from them.
Screenshots
