Title: Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail
Author: Dragon Core
Published: September 8, 2026
Last modified: September 8, 2026
---
Search plugins
# Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail
By [Dragon Core](https://profiles.wordpress.org/dragoncoreltd/)
[Download](https://downloads.wordpress.org/plugin/dragon-activity-log.1.0.14.zip)
* [Details](https://wordpress.org/plugins/dragon-activity-log/#description)
* [Reviews](https://wordpress.org/plugins/dragon-activity-log/#reviews)
* [Installation](https://wordpress.org/plugins/dragon-activity-log/#installation)
* [Development](https://wordpress.org/plugins/dragon-activity-log/#developers)
[Support](https://wordpress.org/support/plugin/dragon-activity-log/)
## Description
Dragon Activity Log records what happens on your WordPress site in a fast, searchable
audit trail that lives in its own database table. Unlike a plain event list, it
shows the **field-level change** for the fields listed below (the old role and the
new role, the old setting value and the new one, a renamed title or slug), and it
links every event to the one before it with a SHA-256 hash so that a later edit
or deletion of the log can be detected.
Everything in this plugin is free and fully functional: every event type, no cap
on the number of events stored, any retention window including “keep forever”, all
filters and search, live updates, integrity verification, and the WP-CLI commands.(
Individual values in the change detail are shortened at 500 characters.)
#### Why Dragon Activity Log
* **Field-level change detail** – before and after values for post title, slug
and excerpt, user email, display name, URL and roles, media title, caption and
alt text, and single-value settings (array settings show their item count; post
bodies are flagged as changed, not stored)
* **Tamper-evident hash chain** – every event is chained to the previous one; one
click checks the chain (up to 25 seconds in the browser; the WP-CLI command checks
a log of any size end to end) and reports the first event whose link no longer
matches
* **Off-site anchor** – email (and optionally post to a signed webhook) the chain
head daily or weekly, then compare the log against any anchor later: proof that
the log was not rewritten, even by someone with database access
* **Site Health** – an integrity test and an anchor test on the Site Health screen,
plus a debug-information section
* **Fast and lean** – events live in their own indexed table, never in your posts
table, and are pruned automatically on the retention window you choose
* **Live activity stream** – new activity appears on the log screen as it happens
* **Privacy controls** – capture, anonymize or skip IP addresses, and exclude trusted
roles from logging
* **Privacy tools integration** – events caused by a user, events about their account,
failed logins against their username or email, and events about comments they
wrote (guests included) are covered by WordPress personal data export and erasure
requests
* **WP-CLI** – `wp dragon-activity-log list`, `prune` and `verify`
#### What gets logged
* **Logins** – successful logins, logouts, failed logins, password resets
* **Users** – registration, profile changes, role changes, deletion
* **Content** – posts, pages and custom post types: create, edit, status change,
trash, restore, delete
* **Plugins and themes** – activate, deactivate, install, update, delete, switch
* **Settings** – WordPress and plugin option changes and deletions, with secret-
shaped values redacted (option writes made by background cron tasks are skipped
unless they touch core settings)
* **Media** – uploads, title, caption and alt text edits, deletions
* **Taxonomies** – term create, edit and delete for categories, tags, menus and
custom taxonomies
* **Comments** – submitted, approved, unapproved, spam, trashed, deleted
* **Core** – WordPress core updates and content exports
#### WP-CLI
* `wp dragon-activity-log list [--limit=] [--event=]`
* `wp dragon-activity-log prune`
* `wp dragon-activity-log verify`
#### Dragon Activity Log Pro
[Dragon Activity Log Pro](https://dragoncore.ltd/plugins/dragon-activity-log-pro)
is a separate paid add-on that adds rich content diffs and one-click rollback, security
alerts, streaming to Slack, webhooks and syslog, session management, reports with
CSV and JSON export, and WooCommerce events. None of that code ships in this plugin,
and nothing here is limited or locked without it.
### External services
This plugin does not connect to any external service of ours or of any third party.
All logging, hashing and verification runs on your own server.
The optional off-site anchor sends the chain head (an event number, a hash, your
site URL and a timestamp; never any event data) to a destination you configure:
by email through your site’s normal mail delivery, and, only if you enter a webhook
URL, by an HTTPS POST to that URL. Nothing is sent unless you turn the anchor on.
### Privacy Policy
Dragon Activity Log stores activity data locally in your WordPress database, including
usernames, IP addresses (unless disabled or anonymized), and details of changes
made on your site. It does not send any data to third parties. IP capture can be
disabled or anonymized in the settings. WordPress personal data export and erasure
requests are matched by email address and cover events caused by the user, events
about their account, failed logins against their username or email, and events about
comments written with that email (so guest commenters are covered too). Events about
comments that have since been deleted can no longer be matched to an email address.
## Screenshots
[⌊The activity log: field-level change detail, severity pills and live updates.⌉⌊
The activity log: field-level change detail, severity pills and live updates.⌉[
The activity log: field-level change detail, severity pills and live updates.
[⌊Filtering the log by object type, event, severity and date.⌉⌊Filtering the log
by object type, event, severity and date.⌉[
Filtering the log by object type, event, severity and date.
[⌊Integrity tab: verifying the tamper-evidence hash chain and anchoring the chain
head off-site.⌉⌊Integrity tab: verifying the tamper-evidence hash chain and anchoring
the chain head off-site.⌉[
Integrity tab: verifying the tamper-evidence hash chain and anchoring the chain
head off-site.
[⌊Settings tab: retention, IP privacy controls, chain anchor and excluded roles.⌉⌊
Settings tab: retention, IP privacy controls, chain anchor and excluded roles.⌉[
Settings tab: retention, IP privacy controls, chain anchor and excluded roles.
## Installation
1. Upload the `dragon-activity-log` folder to `/wp-content/plugins/`, or install it
from the Plugins screen.
2. Activate the plugin through the Plugins screen in WordPress.
3. Go to Tools > Activity Log. Events start recording immediately; the Settings tab
holds retention and privacy options.
## FAQ
### Does this slow down my site?
Logging is a single indexed database write per action. The tamper-evidence hashing
runs separately: an hourly WP-Cron job, plus a short end-of-request pass on roughly
one request in twenty (capped at 200 events and two seconds) after the page has
been generated.
### How does the tamper-evidence work?
Each event stores a SHA-256 hash computed over its own contents plus the previous
event’s hash, forming a chain. Editing or deleting any event breaks the chain from
that point on, and the integrity check reports the first broken link. This is tamper
_evidence_: it detects edits and deletions made outside the plugin, it does not
prevent someone with database access from making them. Use it alongside normal access
control and backups.
### What can the integrity check not catch?
Two things, by design. First, events are hashed into the chain by a background pass(
hourly, plus a short end-of-request pass), so a row deleted before it is sealed
leaves no trace; on a quiet site without WP-Cron traffic that window can be up to
an hour. Second, someone with write access to your database who also recomputes
every later hash and the stored chain head can hide an edit from the self-check.
That is what the off-site anchor is for: compare the log against an anchor you received
earlier and such a rewrite is caught. Clearing the log or erasing someone’s data
rebuilds the chain; the event that records it says whether the chain was intact
beforehand.
### How does the off-site anchor work?
On the Settings tab, choose daily or weekly. On that schedule the plugin seals the
chain and emails the chain head (an event number and a hash, never any event data)
to the address you choose; ideally one outside this site. You can also have it posted
to an https webhook you control, signed with a per-site secret. Keep those messages.
At any time, paste an anchor reference into Integrity > “Compare with an anchor”(
or run `wp dragon-activity-log verify --anchor=`): the plugin recomputes
the chain up to that event and confirms it still produces the anchored hash. “Send
anchor now” takes one immediately.
### Does the plugin send data anywhere?
No. Events are stored in a dedicated `wp_dal_events` table in your own database.
Nothing is sent to Dragon Core or any third party.
### Which IP address is recorded?
By default the connecting address (REMOTE_ADDR). Proxy headers such as X-Forwarded-
For are ignored unless you enable “Trust proxy headers”, because visitors can forge
them. You can also anonymize IP addresses or turn capture off entirely.
### Can I keep events forever?
Yes. Set the retention to 0 days on the Settings tab.
### What is not logged?
Editor autosaves, background (cron) option writes other than core settings, the
plugin’s own bookkeeping options, first/last name, nickname and biography changes(
email, display name, URL, password and roles are covered), network-wide (multisite)
settings, and the success of each package in a bulk plugin or theme update (the
update run is recorded per requested package). When “Trust proxy headers” is on,
the address appended by the single proxy in front of the site is used; chains of
several proxies are not walked.
### What is redacted?
Option and field names that look like secrets are recorded as “[redacted]” and their
values are never read by the plugin: anything containing password, pass, pwd, secret,
token, auth, nonce, salt, private, api, license, licence or credential, or containing
_key. Password changes are recorded as “(changed)”, never the hash. Post bodies
are never stored, only the fact that the content changed.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail”
is open source software. The following people have contributed to this plugin.
Contributors
* [ Dragon Core ](https://profiles.wordpress.org/dragoncoreltd/)
[Translate “Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail” into your language.](https://translate.wordpress.org/projects/wp-plugins/dragon-activity-log)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/dragon-activity-log/),
check out the [SVN repository](https://plugins.svn.wordpress.org/dragon-activity-log/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/dragon-activity-log/)
by [RSS](https://plugins.trac.wordpress.org/log/dragon-activity-log/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.14
* Listing only: a clearer WordPress.org title and tags, so people searching for
an audit log or user activity trail can find the plugin. No functional changes.
#### 1.0.13
* Adds a one-time WordPress.org review prompt on the Activity Log screen after
your first integrity check or anchor. No other changes.
#### 1.0.12
* New: off-site chain anchor. Email the chain head daily or weekly (optionally
also to a signed webhook you control), send one on demand, and compare the log
against any anchor from the Integrity tab or WP-CLI (`verify --anchor=`). Each anchor is recorded in the log itself.
* New: Site Health integration. An “Activity log integrity” test, an “off-site
anchor” test, and a Dragon Activity Log section under Info.
#### 1.0.11
* Secret-shaped settings (API keys, tokens, passwords, licences) are no longer
read at all when they change or are deleted: the event still records that the
setting changed, but the value is dropped at the source and is not passed to
add-ons either.
#### 1.0.10
* Integrity chain hardening: the hash now covers the event id and uses an unambiguous
encoding, so a row cannot be renumbered or have field boundaries shifted unnoticed.
Existing chains are rebuilt once after updating (the log itself is untouched).
* Verification now says exactly what it checked: it reports events not yet sealed,
tells you when it ran out of time on a very large log, and no longer reports “
intact” when another process held the lock.
* Clearing the log or erasing someone’s data checks the chain first and records
the outcome; an erasure that removes nothing leaves the chain alone.
* Retention cleanup removes a contiguous block of oldest events and re-anchors
after every batch, so an interrupted run can never leave the chain unverifiable;“
Run cleanup now” applies the number in the retention field, saved or not, and
says so.
* Optional list of trusted proxy addresses (IPs or CIDR ranges): when set, proxy
headers are honoured only for connections from those addresses.
* Screen Options on the log now work: choose how many events to show per page and
hide columns; live-stream rows respect hidden columns, keep the page at its size
and update the item count.
* Hosts whose database cannot provide advisory locks (for example Galera clusters)
fall back to an option-row lock, so sealing and cleanup keep running there.
* The background sealer re-reads the chain state from the database before every
write, so a persistent object cache cannot hand it a stale copy.
* The events table is created on first load for any site that never ran activation,
not only on admin visits.
* Live-stream rows now show the object type and the field-level change table, exactly
like rows rendered on load; a log cleared from another tab reloads open log screens;
a lost session shows a message instead of silently stopping; typing a page number
in the pagination box works.
* Publishing a draft while editing it records one event carrying both the status
change and the field changes (previously the field changes were lost). Role additions
and removals, and network user deletions, are recorded.
* Less noise: editor autosaves of a draft, and the two option writes behind a theme
switch, no longer add rows (the theme switch itself is still logged). On a network,
option changes made while switched to another site are recorded on that site.
* JSON-encoded settings values are summarised like arrays instead of being stored
verbatim, so a credential nested inside one never reaches the log.
* Comment status events use translated labels; setting an image’s alt text for
the first time logs once.
* Accessibility: the active tab is announced, and change-detail field names are
proper row headers.
* A missing events table (restored database, manual drop) is recreated on the next
request instead of surfacing database errors.
#### 1.0.9
* The log, integrity check and settings now live on one Tools > Activity Log screen
with tabs instead of three separate Tools menu entries. Old links redirect.
* Live updates pause automatically while a filter, search or a page other than
the first is active, so filtered views are no longer interrupted by unfiltered
rows.
* Severity is shown with the Dragon design system’s tinted pills and row markers,
and the integrity and cleanup messages are now translatable.
* New “Run cleanup now” button on the Settings tab applies the retention window
immediately.
* Events are no longer recorded before WordPress has finished loading, which fixes
a “translation loading triggered too early” notice when another plugin crashed
during startup.
* Logins, logouts and password resets are now attributed to the user concerned
instead of “System / Guest” (WordPress fires those hooks before it sets the current
user), so role exclusions apply to them and privacy export and erasure cover
them.
* Personal data export and erasure now include events about the user’s account
and failed logins against their username, not only events they caused.
* Media alt text changes are recorded with the old and new value; previously that
field never showed a difference.
* Changes to the plugin’s own settings are logged, and clearing the log records
a “log cleared” event as the first row of the new chain.
* Date filters use the site’s timezone; the retention field only accepts whole
days; the daily cleanup and chain reset now coordinate with the background sealer
so a rare overlap cannot leave the chain unverifiable.
* The events table is created on sites that never ran activation (network activation
only runs it on the main site) and schema updates apply on upgrade.
* Uninstalling with “Delete all data” opted in now also removes that setting itself,
and on a network it runs for every site.
* Network activation creates the events table on every site, and new network sites
get one automatically.
* Fresh plugin and theme installs are recorded (previously only updates were);
deleted options are recorded too.
* The live stream delivers bursts larger than one page across consecutive polls
instead of skipping the middle, and guest rows show the “System / Guest” label.
* The migration of settings from the 1.0.0 option names has been removed; sites
still on 1.0.0 start with default settings after updating.
#### 1.0.8
* Retention: the retention setting now accepts 0 to keep events forever. Any retention
window, or none at all, is available in the free plugin.
#### 1.0.7
* Security: integrity verification now detects truncation of the newest sealed
log entries (deleting the tail no longer passes as “verified”).
#### 1.0.6
* Compatibility: tested up to WordPress 7.1.
* Housekeeping: corrected the contributor name in the plugin readme.
#### 1.0.5
* Accessibility: screen-reader labels on the log filters and table header scopes
throughout.
#### 1.0.4
* Data safety: uninstalling the plugin no longer deletes its data unless you explicitly
opt in first. A reinstall now picks up exactly where you left off. (New setting.)
#### 1.0.3
* New look: the Dragon design system arrives. A consistent Dragon Core header,
cleaner tables, and unified status colours. Purely visual; no behaviour changes.
#### 1.0.2
* Fix: the integrity-chain state is now carried safely on a deactivate then reactivate
update (it could previously reset).
#### 1.0.1
* Renamed all option, hook, function and constant prefixes to the unique `dragonactivitylog_`/`
DRAGONACTIVITYLOG_` prefix. Existing settings and the integrity-chain state are
migrated automatically on update; the event table is unaffected.
#### 1.0.0
* Initial release.
## Meta
* Version **1.0.14**
* Last updated **10 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.2 or higher **
* Tested up to **7.1**
* PHP version ** 8.0 or higher **
* Tags
* [Activity Log](https://wordpress.org/plugins/tags/activity-log/)[audit log](https://wordpress.org/plugins/tags/audit-log/)
[audit trail](https://wordpress.org/plugins/tags/audit-trail/)[security](https://wordpress.org/plugins/tags/security/)
[user activity](https://wordpress.org/plugins/tags/user-activity/)
* [Advanced View](https://wordpress.org/plugins/dragon-activity-log/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/dragon-activity-log/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/dragon-activity-log/reviews/)
## Contributors
* [ Dragon Core ](https://profiles.wordpress.org/dragoncoreltd/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/dragon-activity-log/)