Is your website ready for a cybersecurity audit?<\/p>\n\n
When a website is hacked, the first thing intruders do is modify database logs to cover their tracks. Standard security plugins log user actions, but they do not guarantee that the logs themselves have not been altered or deleted.<\/p>\n\n
Compliance Audit Log & Tamper-Evident Security Trail<\/strong> transforms your WordPress dashboard into a secure GRC (Governance, Risk, and Compliance) platform. By combining real-time activity tracking with cryptographic SHA-256 chain verification, it ensures your security audit trails are immutable, verified, and legally defensible.<\/p>\n\n Every log entry calculates a SHA-256 signature containing its contents and the signature of the preceding row. If an unauthorized actor inserts, deletes, or edits a log record directly in the database, the cryptographic chain breaks. The built-in verifier identifies exactly when and where the compromise occurred.<\/p>\n\n Designed to assist compliance officers, developers, and security teams in meeting strict international guidelines:\n* NIS2 Directive (EU)<\/strong>: Fulfill Article 21 risk management and operational logging.\n* DORA (Digital Operational Resilience Act)<\/strong>: Monitor ICT incident events and operational resilience.\n* SOC 2 & ISO 27001<\/strong>: Satisfy access control monitoring and configuration audit requirements.\n* GDPR & HIPAA<\/strong>: Mask IPs using HMAC-SHA-256 salted hashes and support data erasures.<\/p>\n\n Unlock advanced features to manage cyber risks and supply chains networked across your organization:\n* Off-site Evidence Vaults:<\/strong> Synchronize encrypted logs to AWS S3, Google Cloud, Azure, or SFTP.\n* Automated Incident Detection:<\/strong> Trigger Slack, Discord, and Email alerts on brute force and privilege escalations.\n* AI Incident Analysis:<\/strong> Suggest root-cause mitigations using integrated OpenAI, Claude, and Gemini models.\n* Auditor Portal:<\/strong> Generate secure, expirable, read-only dashboard links for external compliance checkers.\n* Risk & Vendor registers:<\/strong> Track supplier risk metrics using an interactive 5x5 Heat Map.\n* File Integrity Monitor:<\/strong> Validate core system checksums using official WordPress.org APIs.<\/p>\n\n\n Every log entry combines its ID, message, timestamp, and metadata with the hash of the preceding entry to calculate its own SHA-256 signature. If a database record is altered, its signature changes, causing validation checks to fail for that row and all subsequent rows.<\/p><\/dd>\n No. The plugin uses an asynchronous-like queue. Logs are stored in memory during the runtime and written to the database during the WordPress Yes. The plugin is fully multisite-ready, supports network-wide activation, and stores logs with site identifiers to allow filtering by site.<\/p><\/dd>\n Yes. When IP address anonymization is enabled (default), client IPs are salted and hashed using HMAC-SHA-256 before insertion. They cannot be reversed to reveal the raw IP.<\/p><\/dd>\n No. The free version does not limit the number of logs, exports, or evidence snapshots you can generate.<\/p><\/dd>\n Go to 'Compliance Logs' -> 'Integrity Center' and click the 'Run Integrity Verification' button. The verifier will scan all records and report if any anomalies are found.<\/p><\/dd>\n If the Integrity Center reports a compromised status, it lists the exact log ID where the validation failed, indicating that the database row was modified or deleted.<\/p><\/dd>\n The Evidence Vault takes a snapshot of your site's technical configuration (plugins list, theme versions, user capability definitions, security constants). It provides proof of the site's state at a specific point in time.<\/p><\/dd>\n Yes. You can generate CSV or JSON log exports from the Export Center, using filters like date ranges, compliance categories, or severity levels.<\/p><\/dd>\n Yes. The plugin creates custom capabilities ( If enabled in settings, the plugin runs a daily or weekly cron job to capture system configuration archives.<\/p><\/dd>\n Yes. When a WordPress data erasure request is completed for a user, the plugin anonymizes their data and automatically rebuilds the hash chain to keep the cryptographic audit trail unbroken.<\/p><\/dd>\n All data is stored locally in dedicated custom database tables (Cryptographic Log Integrity<\/h4>\n\n
Fulfill Global Compliance Regulations<\/h4>\n\n
Features (Free Version)<\/h4>\n\n
\n
Upgrade to Pro for Enterprise Governance<\/h4>\n\n
\n
tbsh-compliance-audit-logger<\/code> folder to the \/wp-content\/plugins\/<\/code> directory.<\/li>\n\n
How does the cryptographic hash chain protect my logs?<\/h3><\/dt>\n
Does this plugin affect page load times?<\/h3><\/dt>\n
shutdown<\/code> hook, after the page has finished loading for the visitor.<\/p><\/dd>\nCan I use this on a WordPress Multisite network?<\/h3><\/dt>\n
Are IP addresses stored in a GDPR-compliant manner?<\/h3><\/dt>\n
Does the free version have any logs limits?<\/h3><\/dt>\n
How do I run a database validation check?<\/h3><\/dt>\n
What happens if the hash chain is compromised?<\/h3><\/dt>\n
How does the Evidence Vault work?<\/h3><\/dt>\n
Can I export logs for external analysis?<\/h3><\/dt>\n
Does this plugin support capability-based access?<\/h3><\/dt>\n
tbsh_cal_view_logs<\/code>, tbsh_cal_view_evidence<\/code>, tbsh_cal_export_data<\/code>, tbsh_cal_manage_settings<\/code>, tbsh_cal_verify_integrity<\/code>) assigned to administrators by default.<\/p><\/dd>\nHow often does it capture automated snapshots?<\/h3><\/dt>\n
Does it support WP GDPR Personal Data Erasure?<\/h3><\/dt>\n
Where is the log data stored?<\/h3><\/dt>\n
wp_tbsh_cal_logs<\/code>, wp_tbsh_cal_evidence<\/code>, wp_tbsh_cal_integrity<\/code>). No logs are written to default options tables.<\/p><\/dd>\n