Title: Shibisty Sharing Activity Detector Author: Alexander Shibisty Published: September 29, 2026 Last modified: September 29, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/shibisty-sharing-activity-detector.svg) # Shibisty Sharing Activity Detector By [Alexander Shibisty](https://profiles.wordpress.org/shibisty/) [Download](https://downloads.wordpress.org/plugin/shibisty-sharing-activity-detector.5.0.2.zip) * [Details](https://wordpress.org/plugins/shibisty-sharing-activity-detector/#description) * [Reviews](https://wordpress.org/plugins/shibisty-sharing-activity-detector/#reviews) * [Installation](https://wordpress.org/plugins/shibisty-sharing-activity-detector/#installation) * [Development](https://wordpress.org/plugins/shibisty-sharing-activity-detector/#developers) [Support](https://wordpress.org/support/plugin/shibisty-sharing-activity-detector/) ## Description Shibisty Sharing Activity Detector logs requests (page views, REST/AJAX calls, admin- area hits, and optional heartbeat pings) into a dedicated database table, then groups them into sessions per user/device. From that it computes, for each user: * **Range** — the sum of all active time intervals (how long the user was actually on the site). * **Total per device** — the sum of each device’s active time, computed separately. * **Parallel time** — `Total − Range`. A value greater than zero means two or more devices were active for the same user at the same time, which is the core signal this plugin is built to detect (e.g. a shared account being used from two locations at once). Session boundaries are computed with a simple gap rule: if two consecutive requests from the same user/device are ≤ 5 minutes apart, they belong to the same session and the time between them is counted; a gap of more than 5 minutes is treated as the user having left, and that gap is _not_ counted toward active time. ### Admin screens All screens live under **Suspicious Activity** in the admin menu (`manage_options` capability required): * **Activity** (`wp-suspicious-activity`) — list of users with a suspicious-activity timeline, sortable/filterable. * **Request Logs** (`wp-sad-request-logs`) — full paginated log of every recorded request, with filters and sortable columns. * **Settings** (`wp-sad-settings`) — logging rules and heartbeat. * **Log View** (`wp-sad-log-view`, hidden) — detail view of a single log entry, linked from the Request Logs list. * **Activity View** (`wp-sad-activity-view`, hidden) — detail view of a single user’s activity/timeline, linked from the Activity list. Filter selections on the Activity and Request Logs screens are remembered in the browser (`localStorage`) and restored on your next visit; the Reset button always clears them and returns to the default view. Wherever a user is identified from a session, their name links directly to their WordPress profile/edit-user page. ### Settings Found under **Suspicious Activity Settings**: * **Audience (who gets logged)** — All users (including guests), Registered users only, or Admins only. * **Logging scope (what gets logged)** — all pages/API/admin area, only pages and heartbeat, only the site excluding admin area and heartbeat, only admin area and heartbeat, or stop logging entirely. * **Logging window (when to log)** — Always, or only during a specific time-of- day window (`from`–`to`). Windows that cross midnight (e.g. `22:00`–`06:00`) are supported. * **Heartbeat** — enable/disable, plus a configurable ping interval (15–600 seconds). When enabled, a small script pings the plugin’s own REST endpoint (`/wp-json/ wp-sad/v1/heartbeat`) at that interval for as long as the browser tab is open and visible, so active time is counted accurately even between page loads, without relying on `admin-ajax.php`. ### Localization The plugin’s source strings are in English (`shibisty-sharing-activity-detector` text domain, `.pot` template included in `/languages`) and hand-written translations already exist for 30 additional languages — Ukrainian, Russian, German, French, Spanish, Italian, Portuguese (Brazil), Portuguese (Portugal), Polish, Dutch, Romanian, Czech, Hungarian, Bulgarian, Greek, Turkish, Swedish, Finnish, Lithuanian, Croatian, Serbian, Georgian, Azerbaijani, Kazakh, Belarusian, Arabic, Hebrew, Hindi, Chinese( Simplified), and Japanese. Like every WordPress.org-hosted plugin, translations are delivered through translate.wordpress.org and applied automatically based on each admin’s own profile language — there’s no plugin-specific language setting. ### Architecture The plugin is split into logic and presentation layers rather than one monolithic file: ``` ` ``` shibisty-sharing-activity-detector/ ├── shibisty-sharing-activity-detector.php # Bootstrap: constants, requires, activation ├── includes/ │ ├── class-plugin.php # Orchestrator: hooks, wiring │ ├── class-db.php # Table name/schema, install + upgrade( dbDelta), checked on every init │ ├── class-settings.php # Settings storage and sanitization │ ├── class-request-logger.php # Classifies + gates + records each request │ ├── class-heartbeat.php # REST heartbeat route + front-end pinger │ ├─ ─ class-session-analyzer.php # Pure session/timeline/risk calculation logic │ ├─ ─ class-view-helpers.php / class-query-helpers.php │ ├── class-admin-menu.php # Menu registration, asset enqueueing │ └── admin/ # Page controllers (Activity, Request Logs, Log View, Activity View, Settings) ├── views/ # Plain PHP templates — no business logic or queries ├── assets/ # css/, js/ (timeline UI, filter persistence, heartbeat pinger) └── languages/ # .pot template (translations delivered via translate.wordpress. org) ` Request records carry a `request_type` (`page`, `api`, `admin`, or `heartbeat`), set at write time, which the session analyzer uses to decide what counts as a genuine presence signal versus administrative/system noise. ## Installation 1. Copy the `shibisty-sharing-activity-detector` folder into `wp-content/plugins/`, or install it as a zip from the Plugins Add New screen. 2. Activate **Shibisty Sharing Activity Detector** from the WordPress admin Plugins screen. 3. The plugin creates its own table (`{$wpdb->prefix}request_logs`) automatically on activation, and also re-checks the table/schema on every `init` — so the table is repaired automatically if it’s ever missing, without needing to reactivate the plugin. 4. Visit **Suspicious Activity Settings** to choose who gets logged, what gets logged, and whether heartbeat is enabled. ## FAQ ### Does this plugin delete any data when deactivated or uninstalled? No. The plugin does not delete its data on deactivation, and uninstalling/deleting the plugin does not currently remove the `request_logs` table or its data either. Back it up or drop it manually if you need a clean removal. ### Can I add a language that isn’t available yet? Yes, the standard WordPress.org way: contribute the translation on [translate.wordpress.org](https://translate.wordpress.org/) using `shibisty-sharing-activity-detector.pot` (included in `/languages`) as the reference for all translatable strings. Once a locale reaches 100% (or the site’s configured threshold), WordPress downloads and applies it automatically — no plugin update needed. ### Can heartbeat data be added retroactively for past traffic? No. Heartbeat and `request_type`-aware session data are only accurate for traffic recorded after the relevant setting was enabled; there’s no way to reconstruct heartbeat signal for historical requests. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Shibisty Sharing Activity Detector” is open source software. The following people have contributed to this plugin. Contributors * [ Alexander Shibisty ](https://profiles.wordpress.org/shibisty/) [Translate “Shibisty Sharing Activity Detector” into your language.](https://translate.wordpress.org/projects/wp-plugins/shibisty-sharing-activity-detector) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/shibisty-sharing-activity-detector/), check out the [SVN repository](https://plugins.svn.wordpress.org/shibisty-sharing-activity-detector/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/shibisty-sharing-activity-detector/) by [RSS](https://plugins.trac.wordpress.org/log/shibisty-sharing-activity-detector/?limit=100&mode=stop_on_copy&format=rss). ## Changelog ### 5.0.2 * Rewrote the plugin as an MVC-style architecture (includes/admin/views/assets) instead of a single monolithic file. * Fixed a session-time calculation bug where the signal-type filter was inverted, and where `admin-ajax.php` requests were being skipped entirely. * Added settings for logging audience, scope, time window, and heartbeat. * Added Request Logs, Log View, Activity View, and Settings admin pages. * Added a user-type filter (All / Registered / Admins) and `localStorage`-based filter persistence. * Made the plugin translation-ready with an English source and a `.pot` template; hand-written translations exist for 30 additional languages and roll out via translate.wordpress.org. ## Meta * Version **5.0.2** * Last updated **18 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [activity monitor](https://wordpress.org/plugins/tags/activity-monitor/)[audit log](https://wordpress.org/plugins/tags/audit-log/) [security](https://wordpress.org/plugins/tags/security/)[session tracking](https://wordpress.org/plugins/tags/session-tracking/) * [Advanced View](https://wordpress.org/plugins/shibisty-sharing-activity-detector/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/shibisty-sharing-activity-detector/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/shibisty-sharing-activity-detector/reviews/) ## Contributors * [ Alexander Shibisty ](https://profiles.wordpress.org/shibisty/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/shibisty-sharing-activity-detector/)