Dragon Activity Log Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Dragon Activity Log records what happens on your WordPress site in a fast, searchable audit trail that lives in its own database table. Unlike a plain event list, it shows the field-level change for the fields listed below (the old role and the new role, the old setting value and the new one, a renamed title or slug), and it links every event to the one before it with a SHA-256 hash so that a later edit or deletion of the log can be detected.
Everything in this plugin is free and fully functional: every event type, no cap on the number of events stored, any retention window including “keep forever”, all filters and search, live updates, integrity verification, and the WP-CLI commands. (Individual values in the change detail are shortened at 500 characters.)
Why Dragon Activity Log
- Field-level change detail – before and after values for post title, slug and excerpt, user email, display name, URL and roles, media title, caption and alt text, and single-value settings (array settings show their item count; post bodies are flagged as changed, not stored)
- Tamper-evident hash chain – every event is chained to the previous one; one click checks the chain (up to 25 seconds in the browser; the WP-CLI command checks a log of any size end to end) and reports the first event whose link no longer matches
- Off-site anchor – email (and optionally post to a signed webhook) the chain head daily or weekly, then compare the log against any anchor later: proof that the log was not rewritten, even by someone with database access
- Site Health – an integrity test and an anchor test on the Site Health screen, plus a debug-information section
- Fast and lean – events live in their own indexed table, never in your posts table, and are pruned automatically on the retention window you choose
- Live activity stream – new activity appears on the log screen as it happens
- Privacy controls – capture, anonymize or skip IP addresses, and exclude trusted roles from logging
- Privacy tools integration – events caused by a user, events about their account, failed logins against their username or email, and events about comments they wrote (guests included) are covered by WordPress personal data export and erasure requests
- WP-CLI –
wp dragon-activity-log list,pruneandverify
What gets logged
- Logins – successful logins, logouts, failed logins, password resets
- Users – registration, profile changes, role changes, deletion
- Content – posts, pages and custom post types: create, edit, status change, trash, restore, delete
- Plugins and themes – activate, deactivate, install, update, delete, switch
- Settings – WordPress and plugin option changes and deletions, with secret-shaped values redacted (option writes made by background cron tasks are skipped unless they touch core settings)
- Media – uploads, title, caption and alt text edits, deletions
- Taxonomies – term create, edit and delete for categories, tags, menus and custom taxonomies
- Comments – submitted, approved, unapproved, spam, trashed, deleted
- Core – WordPress core updates and content exports
WP-CLI
wp dragon-activity-log list [--limit=<n>] [--event=<code>]wp dragon-activity-log prunewp dragon-activity-log verify
Dragon Activity Log Pro
Dragon Activity Log Pro is a separate paid add-on that adds rich content diffs and one-click rollback, security alerts, streaming to Slack, webhooks and syslog, session management, reports with CSV and JSON export, and WooCommerce events. None of that code ships in this plugin, and nothing here is limited or locked without it.
External services
This plugin does not connect to any external service of ours or of any third party. All logging, hashing and verification runs on your own server.
The optional off-site anchor sends the chain head (an event number, a hash, your site URL and a timestamp; never any event data) to a destination you configure: by email through your site’s normal mail delivery, and, only if you enter a webhook URL, by an HTTPS POST to that URL. Nothing is sent unless you turn the anchor on.
Privacy Policy
Dragon Activity Log stores activity data locally in your WordPress database, including usernames, IP addresses (unless disabled or anonymized), and details of changes made on your site. It does not send any data to third parties. IP capture can be disabled or anonymized in the settings. WordPress personal data export and erasure requests are matched by email address and cover events caused by the user, events about their account, failed logins against their username or email, and events about comments written with that email (so guest commenters are covered too). Events about comments that have since been deleted can no longer be matched to an email address.
Screenshots
The activity log: field-level change detail, severity pills and live updates.
Filtering the log by object type, event, severity and date.
Integrity tab: verifying the tamper-evidence hash chain and anchoring the chain head off-site.
Settings tab: retention, IP privacy controls, chain anchor and excluded roles.
