Title: EC Intelligent Log Auditor Author: Entangle Commerce Published: November 6, 2026 Last modified: November 6, 2026 --- Search plugins ![](https://ps.w.org/entangle-log-auditor/assets/banner-772x250.png?rev=3787584) ![](https://ps.w.org/entangle-log-auditor/assets/icon.svg?rev=3787584) # EC Intelligent Log Auditor By [Entangle Commerce](https://profiles.wordpress.org/entanglecommercecom/) [Download](https://downloads.wordpress.org/plugin/entangle-log-auditor.1.0.0.zip) * [Details](https://wordpress.org/plugins/entangle-log-auditor/#description) * [Reviews](https://wordpress.org/plugins/entangle-log-auditor/#reviews) * [Installation](https://wordpress.org/plugins/entangle-log-auditor/#installation) * [Development](https://wordpress.org/plugins/entangle-log-auditor/#developers) [Support](https://wordpress.org/support/plugin/entangle-log-auditor/) ## Description EC Intelligent Log Auditor records administrative activity on your site and gives administrators a searchable audit trail. #### What gets logged * Logins, logouts and failed login attempts * Content created, updated and status changes (any post type; revisions and autosaves are skipped, the static homepage is flagged) * Users created, deleted, profile updates, password and email changes, role changes( including added and removed roles and capabilities written directly to user meta), and application passwords created or revoked * Plugin activation, deactivation and deletion; theme switches and deletion; saves from the built-in plugin and theme file editor * Core, plugin, theme and translation updates and installs * Changes to selected WordPress settings with before/after values (off by default; secret-looking options are never logged) * Changes to EC Intelligent Log Auditor’s own settings and its deactivation (always logged, so the audit trail cannot be switched off unnoticed) Each entry stores the time (UTC), user and role, event, object, IP address, location( with GeoIP), user agent and request URI. Secrets in the URL query string (nonces, tokens, passwords, keys) are redacted. #### Activity Log screen * Summary cards: events and active users in the last 30 days, failed logins in the last 24 hours, and the retention period * The latest 200 entries, searchable by event, username, object or IP * A details dialog for each entry * CSV export of the latest 5,000 entries #### Help Center A built-in Help Center (EC Intelligent Log Auditor > Help Center) answers common questions about logging, privacy, proxies and GeoIP, with search. #### Privacy and retention * IP storage: full, masked (last IPv4 octet / last 64 IPv6 bits zeroed) or a keyed HMAC-SHA256 hash only. Switching to masked or hashed also converts entries already stored, in the background. * Automatic deletion after a configurable number of days (default 90) * Failed logins are rate limited (10 per IP and 60 site-wide per minute by default), with a single summary entry when a limit is reached * Integrates with Tools > Export / Erase Personal Data, and adds suggested text to the privacy policy guide #### Sites behind a proxy or CDN By default the IP address is taken from the connection (REMOTE_ADDR), because forwarding headers can be forged by any visitor. If your site sits behind a load balancer, reverse proxy or CDN, list the proxy addresses in wp-config.php: ``` define( 'LOG_AUDITOR_TRUSTED_PROXIES', '10.0.0.0/8, 2001:db8::/32' ); ``` The client IP is then read from X-Forwarded-For, skipping trusted hops from the right. For Cloudflare, list Cloudflare’s IP ranges and also add: ``` define( 'LOG_AUDITOR_CLIENT_IP_HEADER', 'HTTP_CF_CONNECTING_IP' ); ``` Both values can also be set with the `log_auditor_trusted_proxies` and `log_auditor_client_ip_header` filters. #### GeoIP Location lookups need a GeoLite2-City or GeoIP2-City MMDB database from MaxMind, which is not included. Upload it from Settings, or copy it over SFTP to the path shown there. Previously recorded entries are not backfilled. ## Screenshots [[ [[ [[ [[ [[ [[ [[ ## Installation 1. Activity Log: summary cards for events, active users, failed logins and retention, followed by a searchable table of recent activity. 2. Log details dialog: time, user, event, object, IP, location, request URI and before/ after values for a single entry. 3. Searching the log: filter by event, username, object or IP (here, failed login attempts). 4. Settings: choose which activity types are tracked and who receives the daily email report. 5. Settings: IP storage (full, masked or hashed), retention period, and uploading the optional MaxMind GeoLite2 database for location lookups (not bundled). 6. Daily email report: a 24-hour summary with event counts, most active users and recent high-value events. 7. Help Center: searchable answers about logging, reports, privacy, proxies and GeoIP. ## FAQ ### Does deactivating or deleting the plugin remove my logs? No. Deactivation and uninstall stop the scheduled tasks; the log table and settings are kept. ### Where is the GeoIP database stored? In a randomly named wp-content/uploads/log-auditor-xxxxxxxxxxxxxxxx/ directory; the exact path is shown on the Settings page. It is protected from direct web access on Apache and IIS, and the random name keeps it unguessable elsewhere. On Nginx you can additionally deny access to `/wp-content/uploads/log-auditor-` in your server configuration. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “EC Intelligent Log Auditor” is open source software. The following people have contributed to this plugin. Contributors * [ Entangle Commerce ](https://profiles.wordpress.org/entanglecommercecom/) [Translate “EC Intelligent Log Auditor” into your language.](https://translate.wordpress.org/projects/wp-plugins/entangle-log-auditor) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/entangle-log-auditor/), check out the [SVN repository](https://plugins.svn.wordpress.org/entangle-log-auditor/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/entangle-log-auditor/) by [RSS](https://plugins.trac.wordpress.org/log/entangle-log-auditor/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release. ## Meta * Version **1.0.0** * Last updated **9 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [Activity Log](https://wordpress.org/plugins/tags/activity-log/)[audit log](https://wordpress.org/plugins/tags/audit-log/) [retention](https://wordpress.org/plugins/tags/retention/)[security-log](https://wordpress.org/plugins/tags/security-log/) [user activity](https://wordpress.org/plugins/tags/user-activity/) * [Advanced View](https://wordpress.org/plugins/entangle-log-auditor/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/entangle-log-auditor/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/entangle-log-auditor/reviews/) ## Contributors * [ Entangle Commerce ](https://profiles.wordpress.org/entanglecommercecom/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/entangle-log-auditor/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://buymeacoffee.com/entangle12)