Dragon Activity Log records what happens on your WordPress site in a fast, searchable audit trail that lives in its own database table. Unlike a plain event list, it shows the field-level change for the fields listed below (the old role and the new role, the old setting value and the new one, a renamed title or slug), and it links every event to the one before it with a SHA-256 hash so that a later edit or deletion of the log can be detected.

Everything in this plugin is free and fully functional: every event type, no cap on the number of events stored, any retention window including “keep forever”, all filters and search, live updates, integrity verification, and the WP-CLI commands. (Individual values in the change detail are shortened at 500 characters.)

Why Dragon Activity Log

Field-level change detail – before and after values for post title, slug and excerpt, user email, display name, URL and roles, media title, caption and alt text, and single-value settings (array settings show their item count; post bodies are flagged as changed, not stored)
Tamper-evident hash chain – every event is chained to the previous one; one click checks the chain (up to 25 seconds in the browser; the WP-CLI command checks a log of any size end to end) and reports the first event whose link no longer matches
Off-site anchor – email (and optionally post to a signed webhook) the chain head daily or weekly, then compare the log against any anchor later: proof that the log was not rewritten, even by someone with database access
Site Health – an integrity test and an anchor test on the Site Health screen, plus a debug-information section
Fast and lean – events live in their own indexed table, never in your posts table, and are pruned automatically on the retention window you choose
Live activity stream – new activity appears on the log screen as it happens
Privacy controls – capture, anonymize or skip IP addresses, and exclude trusted roles from logging
Privacy tools integration – events caused by a user, events about their account, failed logins against their username or email, and events about comments they wrote (guests included) are covered by WordPress personal data export and erasure requests
WP-CLI – wp dragon-activity-log list, prune, anchor and verify

What gets logged

Logins – successful logins, logouts, failed logins, password resets
Users – registration, profile changes, role changes, deletion
Content – posts, pages and custom post types: create, edit, status change, trash, restore, delete
Plugins and themes – activate, deactivate, install, update, delete, switch
Settings – WordPress and plugin option changes and deletions, with secret-shaped values redacted (option writes made by background cron tasks are skipped unless they touch core settings)
Media – uploads, title, caption and alt text edits, deletions
Taxonomies – term create, edit and delete for categories, tags, menus and custom taxonomies
Comments – submitted, approved, unapproved, spam, trashed, deleted
Core – WordPress core updates and content exports

WP-CLI

wp dragon-activity-log list [--limit=<n>] [--event=<code>]
wp dragon-activity-log prune
wp dragon-activity-log anchor – send an off-site anchor now
wp dragon-activity-log verify [--anchor=<reference>]

Dragon Activity Log Pro

Dragon Activity Log Pro is a separate paid add-on that adds rich content diffs and one-click rollback, security alerts, streaming to Slack and signed webhooks, session management, reports with CSV and JSON export, and WooCommerce events. None of that code ships in this plugin, and nothing here is limited or locked without it.

External services

This plugin does not connect to any external service of ours or of any third party. All logging, hashing and verification runs on your own server.

The optional off-site anchor sends the chain head (an event number, a hash, your site URL and a timestamp; never any event data) to a destination you configure: by email through your site’s normal mail delivery, and, only if you enter a webhook URL, by an HTTPS POST to that URL. Nothing is sent unless you turn the anchor on.

Credits

The WordPress.org listing icon is drawn with glyphs from Lucide (https://lucide.dev), ISC License. Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather (https://feathericons.com, MIT License). All other copyright (c) for Lucide are held by Lucide Contributors 2022. The plugin itself does not include these icons.

Privacy Policy

Dragon Activity Log stores activity data locally in your WordPress database, including usernames, IP addresses (unless disabled or anonymized), and details of changes made on your site. It does not send any data to third parties. IP capture can be disabled or anonymized in the settings. WordPress personal data export and erasure requests are matched by email address and cover events caused by the user, events about their account, failed logins against their username or email, and events about comments written with that email (so guest commenters are covered too). Events about comments that have since been deleted can no longer be matched to an email address.

Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail