Description
Who Changed It? records what happens on your site — logins, plugin and theme changes, user and role changes, content edits, settings changes, file editor use — and, unlike a plain activity log, classifies every event:
- Normal — routine operation.
- Strange — unusual but not necessarily harmful (a failed login, a settings change, a login at 3 AM).
- Dangerous — high-risk activity you should look at now (brute-force login bursts, new administrator accounts, theme/plugin file editor use, open registration being switched on).
Classification is a two-stage process: every event type has a base severity, and contextual heuristics can escalate it — logins at unusual hours, logins from IP addresses never seen for that user, bursts of failed logins from one IP, bursts of deletions by one user. Every escalation is stored with a human-readable reason shown in the log and in alert emails.
Features
- Color-coded activity log screen with severity icons and per-severity count chips, free-text search, filterable by severity, event type, user, and date range
- Field-level change diffs shown inline: see exactly what changed in a post, profile, or setting
- Immediate email alerts for dangerous events, throttled so a brute-force attack sends one email, not hundreds
- CSV export of the filtered log
- Configurable retention: keep everything, or automatically delete events older than a chosen number of days or months
- Mute individual event types to keep the log signal-heavy (events about the plugin itself can never be muted)
- WooCommerce support: prices, coupons, orders, refunds, store and payment gateway settings
- Extensible: log custom events, adjust severities, watch extra options, or forward events to external systems via hooks
What gets audited
Authentication (logins, failed logins, logouts, password resets), users and roles, plugin and theme installs/updates/activations/deletions, WordPress core updates, WordPress 7.0 AI connector and feature changes, theme/plugin file editor use, posts, pages and media (with field-level diffs of what changed), a watched list of sensitive site options, and data exports. On WooCommerce shops: product price changes, coupon amounts, order status changes, refunds, store settings, and payment gateway configuration.
Installation
- Upload the plugin to
/wp-content/plugins/who-changed-it/, or install it through the Plugins screen. - Activate it through the Plugins screen. The log table is created automatically.
- Find the log under the new “Activity Log” menu item.
If your site runs behind a reverse proxy or CDN, map the real client IP header via the whochita_client_ip filter — otherwise all events will appear to come from the proxy’s address.
FAQ
-
Does it log activity from before it was installed?
-
No. It records events as they happen, starting at activation.
-
How long are events kept?
-
3 months by default. Configure the retention window (or keep all data forever) on the settings screen; developers can additionally use the
whochita_retention_daysfilter. -
Can I change how events are classified?
-
Yes — override the base severity of any event type with the
whochita_base_severity_mapfilter, and extend the list of audited options withwhochita_watched_options. -
Does it work with WooCommerce?
-
Yes. When WooCommerce is active, the plugin automatically also records product price changes (a price drop of more than 50% raises the severity), coupon amount changes, order status changes, refunds, store settings, and payment gateway configuration changes. Gateway secrets and API keys are never stored in the log.
-
Does the plugin send any data to external services?
-
No. Everything is stored in your own WordPress database, and the plugin makes no calls to external services.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Who Changed It? – Activity Log” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Who Changed It? – Activity Log” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.5.0
- WordPress 7.0 AI connector connections and disconnections are now audited without storing API keys.
- AI master-switch and individual WordPress AI plugin feature changes are now audited.
- Admin styles and confirmation behavior now load through the WordPress enqueue APIs.
- Plugin file metadata now uses WordPress APIs, and file-editor auditing verifies request nonces and permissions.
- Internal identifiers now use a unique plugin prefix, filtered database queries are fully prepared, and generated badge markup is escaped at output.
- Empty date filters now use valid database date boundaries, preventing MySQL DATETIME warnings on the activity-log screen.
- A renamed pre-release predecessor is detected so two installed copies cannot register duplicate menus or audit hooks.
- AI connector deletions are audited without reading API-key options, and file-editor auditing now observes the core admin lifecycle hook.
0.4.0
- Field-level change tracking: post updates now record what changed (title, slug, excerpt, author, content word counts, password protection, parent), profile updates record email/display name/website changes, and the log screen displays these diffs inline.
- Free-text search across object names, usernames, event types, IPs, and escalation reasons — the CSV export honors the search too.
- Per-event mute list in the settings: uncheck any event type to stop recording it. Events about the plugin itself can never be muted.
- WooCommerce support: product price changes (a >50% price drop escalates the severity), coupon amount changes, order status changes, refunds, store settings, and payment gateway configuration changes (classified dangerous; secret values are never stored).
0.3.0
- Configurable log retention: keep all data, or delete events older than a chosen number of days/months, with the next scheduled purge shown and a “Purge Old Data” button to run it immediately.
- Events timestamp setting: display log times in UTC or in the timezone configured on the WordPress site (storage stays UTC).
- Factory reset button for the plugin settings (log data untouched) and a purge button that wipes the activity log; the purge is recorded as the first event of the fresh log and classified as dangerous.
0.2.0
- Settings screen: restrict who can change plugin settings (only me / all administrators), grant log viewing to specific users or roles, and customize the From address and display name of alert emails.
- Severity badges now carry icons (check / caution sign / crossed circle) and the log shows clickable per-severity count chips.
- Plugin settings changes are themselves logged as auditable events.
0.1.1
- Neutralize formula-leading values in CSV exports.
- Rate-limit failed-login audit records and add the supporting query index.
- Apply database schema updates automatically after plugin updates.
0.1.0
- Initial release: activity capture, normal/strange/dangerous classification with escalation heuristics, log screen, email alerts, CSV export, retention purge.