What WP Activity Log does on your WordPress site
WP Activity Log, made by Melapress, keeps a record of what happens inside WordPress. It logs logins, logouts and failed logins, changes to content, user accounts and roles, plugin and theme installs, activations and updates, and changes to site settings. Each event shows the date and time down to the millisecond, the user and their role, the source IP address and the object involved, often with the old and the new value.
The log lives in dedicated tables in your WordPress database (wsal_occurrences and wsal_metadata) and you read it from the WP Activity Log menu, placed right below the Dashboard. Every edition also tracks third-party plugins: WooCommerce, Yoast SEO, Rank Math, ACF, Gravity Forms, WPForms, MemberPress and LearnDash. File changes require a second free plugin from the same vendor, Melapress File Monitor.
The free version logs every event, with no cap. Premium ($139 per year for one site) adds advanced search filters, scheduled HTML and CSV reports, email, SMS and Slack notifications, session management (see who is logged in, log a user out, limit simultaneous sessions), targeted data deletion and email support. Enterprise ($189 per year) lets you store the log in an external database, send it to Splunk, AWS CloudWatch or Loggly, or write it to a log file or a syslog server.
Which sites WP Activity Log is a good fit for
- Sites with several administrators or editors: you know who edited a page, changed a role or deactivated a plugin.
- Agencies and freelancers working alongside clients or contractors: the history speeds up troubleshooting after an outage.
- WooCommerce stores and membership sites: changes to products, orders, coupons or MemberPress subscriptions are tracked.
- Sites that must account for who accessed what: adjustable retention and a notice on the login page (see our article on the administrator activity log and GDPR).
It matters less on a site run by a single person, where a simpler plugin such as Simple History or the log built into your security plugin may be enough. WP Activity Log records, it does not block anything: it is neither a firewall nor a login limiter.
WP Activity Log strengths and limitations
Strengths
- Full logging on the free plan. According to the vendor’s FAQ, every event Premium records is also recorded by the free version.
- Detailed events. Old and new values, IP address, role and exact time let you rebuild what happened.
- Wide third-party coverage. WooCommerce and popular SEO, form and membership plugins are supported in every edition.
- Fine control over what gets logged. Each event can be turned on or off by its ID, and you can exclude users, roles, IP addresses or post types.
Limitations
- No alerts or exports on the free plan. Notifications, advanced search filters and CSV or HTML reports need Premium: on the free plan, you have to go and read the log.
- The log sits in the site database. It grows over time, and an intruder who controls the database can alter it; an external database only comes with Enterprise.
- A busy vulnerability record. Several flaws exploitable without an account were patched in 2024, 2025 and 2026.
- Expensive on multisite. The license must cover every site in the network, not just the main site.
The WP Activity Log settings we recommend
Labels from the WP Activity Log 5.6.8 interface. The tabs mentioned are under WP Activity Log > Settings.
| Setting | Recommended value | Why |
|---|---|---|
| Activity log retention Settings > Activity log viewer | “Delete events older than” 6 or 12 months | The setup wizard suggests 3 months. Keep what you need to investigate, no more: the log contains IP addresses. |
| Restrict plugin access Settings > General | “Only me” if one person handles the technical side of the site | Other administrators can no longer change retention or exclusions. |
| Can view events Settings > General | No users added unless there is a specific need | By default only administrators can read the log, which reveals everyone’s activity and IP addresses. |
| Reverse proxy / firewall options Settings > General | “Yes” with your proxy’s header (CF-Connecting-IP behind Cloudflare) | Otherwise the log records the proxy’s address instead of the visitor’s. |
| Login page notification Settings > General | “Yes” on a site with several user accounts | The plugin notes that regulations such as the GDPR require informing users; the text can be edited. |
| Log Level WP Activity Log > Enable/Disable Events | “Basic”, then “Geek” for the length of an investigation | Less noise day to day, full detail when you need it. |
| Enable events for WordPress background activity Settings > Activity log viewer | No (default) | Deleted revisions and auto-drafts would bury the useful events. |
| Remove data on uninstall Settings > Advanced settings | No (default) | Uninstalling and reinstalling keeps the history. Choose Yes only to remove the plugin for good. |
By default the plugin records only 10 failed logins, because logging every attempt of a brute-force attack uses a lot of resources. The setting is on the Enable/Disable Events screen: a value of 0 logs everything, which is best avoided on a heavily targeted site.
- From a private window, a deliberate failed login shows up in the log with your real IP address.
- Editing a test draft shows the old and the new value.
- Below the retention setting, the next purge date matches the period you chose.
- Auto-updates are enabled for WP Activity Log on the Plugins page.
Vulnerabilities in WP Activity Log itself
A plugin that displays outside data in the admin area, such as a username typed on the login page, is exposed to stored XSS vulnerabilities. Patchstack lists about twenty patched flaws in WP Activity Log, several of them exploitable without an account:
- CVE-2024-10793: unauthenticated stored XSS through the
user_idparameter, triggered when an administrator opens the affected page, fixed in version 5.2.2. - CVE-2026-120075: unauthenticated stored XSS up to version 5.6.1, fixed in 5.6.2.
- CVE-2026-54806: unauthenticated PHP object injection (a deserialization flaw) up to version 5.6.3.1, fixed in 5.6.4.
- CVE-2026-62085: SQL injection limited to administrators up to version 5.6.6, fixed in 5.6.7.
Melapress takes reports through the Patchstack vulnerability disclosure program. The useful step is to turn on auto-updates for the plugin (see our guide to automatic plugin updates). WP Masquerade Pro removes the public traces of WP Activity Log (the plugin’s folders and wsal identifiers), which makes it harder for bots hunting its vulnerable versions to spot it, without replacing updates.
What WP Masquerade hides for WP Activity Log
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WP Activity Log: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
No known trace
WP Activity Log FAQ
Is the free version of WP Activity Log enough?
For keeping a record of everything, yes: it logs the same events as Premium. It lacks alerts, filtered search and exports, which matter as soon as several people need to follow the log.
Does WP Activity Log slow down the site?
The vendor says no, but every event is a database write. Limit retention, leave background activity off and keep the cap of 10 recorded failed logins.
Can I hide WP Activity Log from other administrators?
Yes: the “Hide plugin in plugins page” setting (Settings > General) removes it from the plugin list for all users. It shows up again when an update is available, until that update is installed.
Does the log help after a hack?
Yes, it shows new accounts, changed roles and installed plugins, with IP addresses, as long as the intruder has not wiped it from the database. Our guide Has my WordPress site been hacked? covers the other checks.