Enable WordPress Activity Logging for Better Site Security

WordPress Activity Logging gives website owners a window into all of the change and user actions on their website. Want to understand who is making changes to your website and when? Do you have a strange bug that keeps occurring and want to figure out why? Are you required to keep a running tally of changes for compliance reasons? WordPress Activity Logging handles all of that and more.

Activity logging improves the security and performance of your website, as well as increases the accountability within your team.

Why Activity Logging in WordPress is Important

Activity logging is talked about very little in the WordPress world, and that’s a mistake. Given a little attention, it can be an incredibly powerful tool that not only gives website owners useful insights into when changes are made through the WordPress dashboard, it also helps with all of the following:

• Security & Accountability: Track changes and updates to identify potential security breaches or errors made by users.
• Performance Monitoring: Detect changes that may impact site performance, helping to ensure that the site runs smoothly.
• User Accountability: Monitor what different users are doing on the website, helping administrators oversee team actions.
• Troubleshooting: Quickly identify user or system actions that have had unintended consequences, and revert them as quickly as possible.
• Compliance: Support audits and compliance with legal or internal requirements by keeping a record of actions taken on the site.

Continue on and I’ll share some real life examples of how activity logging has come through clutch for the SiteCare team.

WordPress’ Built-in Logging

Out-of-the-box WordPress has some built-in logging capabilities. The primary use-case for WordPress’ logging is debugging errors on the website. If you’ve ever seen a critical or fatal error and can’t access the front end or back end of the website, debug logging is the best option for finding the root of the issue in a pinch.

Enable debug logging by editing your wp-config.php file. If you’re not comfortable touching your website’s code, skip ahead to some more useful logging and monitoring for every day users.

How to Enable WP Debug

You can enable WP Debug and its various options by editing your wp-config.php file. Add the following code toward the end of the file:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );

In this block of code, a few things are happening. WP Debug is disabled in WordPress by default. So the first line of code turns debugging on.

The second line enables logging, which writes any PHP warnings or errors to a file within your WordPress installation called debug.log. You can open that file and view all of the errors behind the scenes.

The last line says not to display the errors on the front end of the website.

This particular configuration is a great way to gather error data without adding a bunch of undecipherable text to the front end of your website. When you’re ready skip logging and have all of the errors and warning display directly on the screen, you can set the last line of the code block to true instead of false.

Taking Logging Further – WordPress Logging Tools

There are a number of plugins and other security services for WordPress that give insights into what’s happening on your WordPress website. Here are some of the most common tools we see working on WordPress websites:

• Wordfence: Security plugin that also logs activity as part of its malware scanning and firewall protection features.
• Sucuri: Another popular security plugin that includes activity monitoring, focused on security incidents.
• Jetpack Security: A broader plugin with activity logs as part of its premium plan.

All of the above security solutions have some type of activity tracking as part of their offerings. However, they’re more of a “kitchen sink” type of security solution and what they do really goes beyond the scope of this blog post.

They also try and do too much, in our opinion. When it comes to protecting websites, we find that the KISS (Keep it Simple Stupid) approach often works best. Find simple plugins or other solutions that focus on solving one security problem and solving it extremely well, rather than providing a myriad of half-solutions in one big package.

Dedicated WordPress Logging Tools

With the KISS approach in mind, we’ll highlight three WordPress plugins that are solely focused on user activity tracking. Here’s a breakdown of the most popular offerings, along with some key features from each:

Plugin	Event Logging	Searchable Logs	Alerts	Plugin support	Privacy
Simple History	✅	✅	❌	✅	✅
WP Activity Log	✅	✅	✅	✅	⚠️
Stream	✅	✅	Premium	✅	⚠️

1. Simple History

Simple History is a lightweight WordPress plugin that logs key activities on your site. It’s designed for ease of use and simplicity, focusing on logging essential events like post changes, user logins, and plugin updates.

Key Features:

• Logs important events such as content changes and login attempts.
• Displays logs directly on the WordPress dashboard.
• Searchable log history and optional email notifications.
• Ideal for users who want straightforward activity tracking without complicated setup.
• Privacy-conscious data storage and data export. Always have full control of how and where your activity data is stored. JSON and CSV exports are both available.
• Control access via WordPress user roles.
• WordPress multisite support.

Simple History also comes with built-in support for a wide range of third-party plugins.

2. WP Activity Log

WP Activity Log is a comprehensive plugin for tracking all user activity on a WordPress site. It offers extensive logs and security alerts, and helps website owners stay on top of every change.

Key Features:

• Tracks every action, from post edits to plugin installations, and user role changes.
• Real-time notifications and alerts for specific actions. This requires a premium subscription.
• Extensive reporting, filtering, and search capabilities for easy management of logs.
• Integration with third-party tools like Slack and email alerts.

WP Activity log is an extremely detailed and powerful logging tool. However, in our experience, that powerful logging comes at a cost. This plugin has been shown to be resource-intensive and can quickly overrun a server, especially on complex websites.

The plugin also uses very aggressive upsell methods to the premium tiers and other marketing materials, which we don’t love seeing in such a critical tool.

3. Stream

Stream is focused on logging user actions for accountability and troubleshooting. It tracks a wide variety of site activities and offers real-time monitoring and notifications.

Key Features:

• Logs a wide range of activities, including content updates, theme changes, and user actions.
• Real-time reporting and notification options for specific events.
• Ability to export log data and filter activity by user or specific action.
• Integration with third-party services like Slack for real-time alerts. Native without a premium subscription.
• Records retention control.

Stream’s minimal interface and smart filters make it a strong offering in the WordPress activity logging space. It’s SiteCare’s runner up behind Simple History.

Using Simple History to Solve Every Day WordPress Issues

Our WordPress activity logging plugin of choice is Simple History. We love the simplicity of the interface, the support for third-party plugins, conscious approach to protecting user privacy and quick searching and filtering to finding a needle in a haystack. Here are some of the ways our team uses Simple History every day to resolve issues for our clients:

Troubleshooting Site Changes

Imagine a WordPress site suddenly starts displaying errors, or certain features are no longer functioning properly. No one on the team recalls making changes.

Simple History to the rescue! It logs changes to plugins, themes, and core settings. By reviewing the activity log we can quickly see if someone installed a plugin or updated a setting, identifying the root cause of the issue.

Just last week we had a client who installed WooCommerce to try out some eCommerce features. However, because they already had a page on their site with the /products/ URL, their standard marketing page was broken when WooCommerce was installed. It took less than 5 minutes to resolve a pressing issue for the client.

Tracking Content Edits

A blog post or page is unexpectedly edited or deleted, and the team isn’t sure who made the change.

Simple History tracks content edits and deletions, allowing the admin to see exactly who made the changes and when, enabling quick corrections or follow-ups with the responsible team member.

Another common issue related to deleted content is when a WordPress user is removed from the website and their content is attributed to another user. All content connected to that user is deleted.

Monitoring User Access and Login Attempts

When suspicious activity or multiple failed login attempts are noticed, and the site admin is concerned about potential security threats, Simple History can help identify malicious activity.

Simple History logs all user logins and failed attempts, making it easier to detect unauthorized access or potential security breaches. Admins can then take action to block IPs or reset compromised passwords.

Keep Your WordPress Site Secure with Activity Logging

Enabling activity logging on your WordPress site is a crucial step in maintaining security, accountability, and performance. Whether you’re managing a small team or overseeing a complex site, keeping track of user actions helps prevent issues and resolve problems more efficiently. Simple History is a straightforward, lightweight solution that provides the essential logging features you need without overcomplicating things.

At SiteCare, all of our Medallion Plans include comprehensive user activity logging along with the assistance of our expert team. We help you keep your WordPress site secure and running smoothly. If you want to ensure every action on your site is monitored and logged, reach out to our team and learn how we can help you maintain the best possible website performance.