Skip to content

Activity

Activity log

Every planAbout Activity Log

Keeps a record of sign-ins, failed attempts, lockouts, user and role changes, password resets, settings changes and the emails Stack Guard sends, with who did it, from which address and when.

What it does

Each event is a line in the Event log: the time, what happened, the user, the internet address and details. Events are grouped as sign-ins, accounts and site changes, and you choose which groups to record.

Plugin and theme changes (optional) also records plugins being activated or deactivated and themes being switched.

Emails records each email Stack Guard sends, such as sign-in codes, unlock links, alerts and reports: which email, when, how many recipients and whether the site's mailer accepted it, with the reason when it did not. It answers "did the client get the code?" without storing the code, the link or the message. Record emails can keep failures only, and Show recipients as chooses between the domain (the default) and the full address.

The Login activity chart on the Monitoring tab draws successful and failed sign-ins over the last 14 days from this log.

Why it matters

When something goes wrong, the first question is "what happened, and who did it?" The log answers it. It also shows attacks as they happen, so you can ban an address or tighten a setting.

Set it up

  1. Go to the Activity tab, section Logging settings, and switch on Activity Logging.
  2. Choose which events to track. Leave them all on unless you have a reason not to.
  3. Set Keep events for, then click Save Changes.
  4. Read the log in section Event log. Use search, the time range and the event type chips to narrow it down, and Export CSV to keep a copy.

Good to know

The log stores internet addresses, which count as personal data in many countries. Keep it no longer than you need and mention it in your privacy policy.

Some security events, such as malware scans, are recorded even when logging is off, so protections leave a trace.

Plugin and theme changes are only recorded while Stack Guard settings changes are tracked too.

Accepted means the site's mailer took the email. Whether it then reached the inbox depends on the mail service and cannot be seen from WordPress. If an email is accepted but never arrives, look at the mail service or an email delivery plugin's own log.

Full recipient addresses stay in the log for the retention period. Changing Show recipients as applies to new entries only. The error text of a failed email always has its addresses, links and long codes removed. Everyone who can open the Activity tab can read the log, including full addresses when they are chosen.

Which plan includes it

The log is in every plan and keeps 7 days on Free. Pro keeps events for as long as you choose and adds search, time range and type filters, CSV export, and logging of plugin and theme changes.

How it works, for developers
  • Events are stored in the smg_activity_log table: user, action, object, details (JSON), address and time in UTC. The browser's user agent is not stored.
  • Tracked groups (option smg_activity_tracked_events): logins, failed and blocked sign-ins, lockouts and bans, user changes, role changes, password resets, two-factor changes, Stack Guard settings, emails.
  • Emails are recorded in one place, SMG_Email::send(), as email_sent or email_failed with object type email. Details hold the email type (for example account:2fa_code, alert:ip_lockouts, report:malware_scan, test), the number of recipients, the recipients as chosen, and on failure the error from wp_mail_failed with addresses removed. Recording follows the activity log switch; a logging error never stops the email.
  • Old events are removed daily by the smg_activity_cleanup task. On Free the window is capped at 7 days whatever is saved.
  • Filters are address parameters (smg_act_cat, smg_act_q, smg_act_range). CSV export gives the latest 5,000 rows.
  • Settings: smg_activity_logging, smg_log_retention_days, smg_log_plugin_changes, smg_email_log_mode (all or failures), smg_email_log_address (domain or full).

Quick answers about activity log

What does Activity log do in Stack Guard?

Each event is a line in the Event log: the time, what happened, the user, the internet address and details. Events are grouped as sign-ins, accounts and site changes, and you choose which groups to record. Plugin and theme changes (optional) also records plugins being activated or deactivated and themes being switched. Emails records each email Stack Guard sends, such as sign-in codes, unlock links, alerts and reports: which email, when, how many recipients and whether the site's mailer accepted it, with the reason when it did not. It answers "did the client get the code?" without storing the code, the link or the message. Record emails can keep failures only, and Show recipients as chooses between the domain (the default) and the full address. The Login activity chart on the Monitoring tab draws successful and failed sign-ins over the last 14 days from this log.

Why use activity log on a WordPress site?

When something goes wrong, the first question is "what happened, and who did it?" The log answers it. It also shows attacks as they happen, so you can ban an address or tighten a setting.

How do I set up activity log?

1. Go to the Activity tab, section Logging settings, and switch on Activity Logging. 2. Choose which events to track. Leave them all on unless you have a reason not to. 3. Set Keep events for, then click Save Changes. 4. Read the log in section Event log. Use search, the time range and the event type chips to narrow it down, and Export CSV to keep a copy.

Which Stack Guard plan includes activity log?

The log is in every plan and keeps 7 days on Free. Pro keeps events for as long as you choose and adds search, time range and type filters, CSV export, and logging of plugin and theme changes.

Not running Stack Guard yet? It is free.

Download Free