Sentinel is an activity log for site owners and developers. It logs who signed in, who edited a page, and which plugin changed. That history is an audit trail: an event log of sign-ins, content, plugins, files, errors, and housekeeping.

You get four screens: Overview, Activity Logs, Event Registry, and Settings. Administrators also get a first-run Quick Setup wizard. Editors who can edit published posts can open Overview and Activity Logs; Event Registry and Settings stay with administrators.

What it records

Built-in events cover:

Sign-ins, sign-outs, failed sign-ins, new accounts, role changes, and profile updates
Posts and pages published, updated, or deleted; comments posted, approved, or deleted
Files added to or removed from the Media Library
Plugin, theme, and WordPress core changes
PHP and WordPress errors, including fatal errors, database errors, and memory pressure
Sentinel’s own housekeeping (cleanup, anonymisation, deletion requests)

If WooCommerce, Contact Form 7, WPForms, or Yoast SEO is active, Sentinel records a small set of those plugin’s events as well (order and payment changes, form submissions without message text, SEO updates). Gravity Forms is not recorded.

You can pause individual event types in Event Registry. You can also skip everyday actions from chosen user roles; critical system errors and role changes are still stored. A new install records every role, including administrators. A site that has already chosen to hide a role keeps that choice.

This is a log, not a firewall. It does not block brute-force logins or scan for malware.

Admin screens

Overview — today’s counts, a week of volume, a heatmap, site health, and recent activity
Activity Logs — searchable history with filters and a detail drawer
Event Registry — the catalogue of what Sentinel can detect, grouped (sign-ins, security, content, plugins and themes, errors, privacy, system, plus integration groups when those plugins are present)
Settings — data and retention, privacy and access, notifications, performance, export and API, maintenance

Email

Mail uses WordPress’s mailer. If the site cannot send email, these switches will not fix delivery.

Urgent alerts — one email when a critical event happens (PHP fatal, database or configuration error, critical memory use, a watched file change, or Sentinel’s own logging rate limit being exceeded). The same type stays quiet until the next day.
Daily summary — one morning briefing: failed sign-ins (counted, not emailed one by one), what changed, and errors
Weekly summary — optional; same briefing template rolled up for the week. Off unless you turn it on.

There is no per-event email filter maze.

Retention, privacy, and export

Live rows can be archived by age and by a maximum live count. Archived rows can be kept or deleted on a schedule.
Optional IP logging on new events. Optional anonymisation of older records (IPv4 and some email or username fields in payloads). IPv6 is not masked today. Anonymisation cannot be undone.
Optional deletion-request form via the [sentinel_data_deletion_request] shortcode. Logged-in users can ask; an administrator still has to approve. This does not delete the WordPress account. There is no per-user export of Sentinel data; administrators can download activity from Settings Export & API (CSV, JSON, or XML).
Optional read-only REST access (sentinel-plugin/v1) behind an API key you generate in Settings.

Files and performance

Optional daily check of wp-config.php and .htaccess. That is a scheduled hash check, not live file watching.

Optional batch writes, a cap on how many events are stored per minute or hour (this protects the database; it is not login protection), and optional memory-pressure handling. Most sites can leave these as they are.

Bundled libraries

Chart.js 4.5.1 (MIT) is included locally at admin/js/vendor/chart.min.js. Upstream source: https://github.com/chartjs/Chart.js
Inter and Poppins (SIL Open Font License) are included at admin/fonts/. See admin/fonts/OFL.txt.

Developer

Sentinel exposes a small companion API. Free stays complete without a companion.

Constant SENTINEL_API = 1
Action sentinel_loaded
Filter sentinel_monitored_files
Filter sentinel_extra_event_definitions and action sentinel_register_extra_events
Filter sentinel_can_register_event
Action sentinel_event_logged ($event_key, full redacted $record, $log_id)
Filter sentinel_settings_extra and sentinel_log_management_pre_update so companion settings persist
Admin: sentinel_admin_menu, sentinel_admin_screen_hooks, sentinel_overview_widgets, sentinel_settings_tabs, sentinel_settings_sections

Use sentinel_log_event() to write. Secrets in payloads, URLs, and user agents (cookies, HMACs, tokens, passwords, API keys) are stripped before storage.

Sentinel – Activity Log