WordPress Activity Log Plugins for Compliance and Auditing
After an incident there is one question nothing else in your stack can answer: what happened, in what order, and who did it. A malware scanner tells you a file is malicious. A firewall tells you traffic was blocked. Neither tells you that a user account was created at 03:12, granted administrator at 03:13, and used to install a plugin at 03:15, which is the sequence that explains everything.
Activity logs are also the least interesting product in WordPress security right up to the day they become the most valuable one. This article covers what a log should record, how to stop it consuming your database, and which of the free and paid options fits.
Verified August 2026. Practical guidance, not compliance advice.
What a log answers that nothing else can
Three situations, and in all three the absence of a log turns a question into a guess.
After a compromise, the log establishes scope. When did the intruder arrive, what did they touch, which accounts did they create, and, critically, is the account you just deleted the only one they made? Without that record you are cleaning files and hoping. With it, you know whether customer data was accessed, which is frequently a legal question rather than a technical one.
After an accident, it answers the more common and more awkward question of who changed the pricing page, or deactivated the caching plugin, or edited a template at four o’clock. On a site with several contributors this is worth the installation on its own, and it resolves disagreements without anyone having to be accused of anything.
For compliance, several regimes expect you to be able to demonstrate who accessed personal data and when. Under data protection law that supports your accountability obligations; under payment card rules it supports the change-detection expectations that took effect in March 2025. In both cases the log is evidence, which means its integrity matters as much as its contents.
The 6 options compared
1. WP Activity Log by Melapress
The most comprehensive option in the category and the one built for organisations that must produce evidence rather than merely satisfy curiosity. Its free version covers a wide range of events, and premium adds the parts that make a log usable at scale.
Three premium capabilities matter here specifically. External database storage keeps the log off the site it is recording, which is the single most important property for evidential value, because a log an intruder can edit is not evidence. Alerting turns a passive record into a control, notifying you when an administrator is created rather than waiting for you to look. And reporting produces the artefact an auditor actually wants instead of a screen you scroll through. Confirm current pricing by site count with the vendor.
- Price: Free version; premium by site count, confirm with vendor
- Storage: External database option on premium
- Best for: Compliance, auditing, and multi-user organisations
- Watch out for: Alerting and external storage are premium
2. Simple History
Free, lightweight, and the right answer for most sites that simply want to know what has been happening. It records logins, post changes, plugin activity, user management and settings changes, and presents them readably.
Its design philosophy is the appeal: it logs what a site owner will actually want to read, rather than everything that can be captured, which keeps both the database and the interface manageable. For a small team, a client site, or a personal project, this is genuinely sufficient, and installing it costs nothing and takes a minute. What it does not offer is external storage, alerting, or the reporting an auditor expects, so if the log needs to be evidence rather than information, look at the option above.
- Price: Free
- Storage: Your database, with automatic pruning
- Best for: Most sites, as a default
- Watch out for: No external storage or alerting
3. Stream
A free plugin with an unusually good filtering interface, which matters more than it sounds once a log has thousands of entries and you are looking for one.
Being able to narrow by user, by action type, by object and by date range turns a log from an archive into a tool. During an incident this is the difference between finding the moment things changed in two minutes and scrolling for twenty. Its records cover the standard set of user, content, plugin and settings events. As with any self-hosted log, the records live in your database and are therefore within reach of anyone who compromises the site, which is a limitation to be aware of rather than a reason to avoid it.
- Price: Free
- Storage: Your database
- Best for: Sites where you will need to search the log
- Watch out for: Records are reachable by anyone who gets in
4. Wordfence’s security audit log
Included with Wordfence Premium at $149 a year per site, and worth knowing about because many sites already pay for it without switching it on.
Its advantage is correlation. Because the same product sees blocked requests, login attempts, file changes and user actions, the log sits alongside the security events rather than in a separate plugin you have to line up manually. During an investigation, seeing that a blocked attack preceded a successful login preceded an administrator being created is the whole story in one place. If you are running Wordfence Premium already, enable it today; if you are not, this is not by itself a reason to buy the licence, since the free logging plugins above cover the ordinary case.
- Price: Included in Wordfence Premium, $149 a year per site
- Storage: Within the Wordfence system
- Best for: Sites already on Wordfence Premium
- Watch out for: Not a reason to buy Premium on its own
5. MalCare activity logs
Logs held on the vendor’s infrastructure rather than in your database, which is the structural property that matters most for evidence. Repair at $299 a year includes 7-day activity logs; Fortify at $499 includes 60 days.
Sixty days is the number worth noticing. A compromise discovered late is the normal case, and a seven-day window frequently predates nothing useful, while sixty days usually reaches back past the point of entry. Off-site storage also means the record survives both a site restore and an intruder with database access, which is exactly when a self-hosted log is least trustworthy. If you are already considering MalCare for cleanup, the log difference between Repair and Fortify is a real part of the $200 gap rather than a feature-list filler.
- Price: Repair $299/yr with 7-day logs; Fortify $499 with 60-day
- Storage: Vendor infrastructure, outside your database
- Best for: Sites wanting logs that survive a compromise
- Watch out for: Seven days is too short to be useful after the fact
6. Server access logs
Free, already being written, and almost universally ignored. Your host records every request to the site, with timestamps, addresses and user agents, in a place that WordPress plugins cannot reach and an intruder inside WordPress usually cannot edit.
That last property makes them the most trustworthy record you have. A plugin log lives in the database; access logs live on the server or with the host, so a compromise of the WordPress installation does not necessarily reach them. They answer different questions than an activity log, showing you requests rather than actions, so you see that someone posted to a particular URL rather than that a user was created. Used together they are complementary: the activity log tells you what changed, the access log tells you who was talking to the site when it did. Find out today how long your host retains them, because it is often shorter than you would like.
- Price: Free, already running
- Storage: Your host, outside WordPress
- Best for: Corroborating an activity log during an investigation
- Watch out for: Host retention is often days, not months
Comparison table
| Option | Price | Storage location | Alerting | Retention |
|---|---|---|---|---|
| WP Activity Log | Free; premium by sites | External DB on premium | Yes, premium | Configurable |
| Simple History | Free | Your database | No | Auto-pruned |
| Stream | Free | Your database | Limited | Configurable |
| Wordfence audit log | $149/yr Premium | Wordfence system | Yes | Plan-dependent |
| MalCare logs | $299 or $499/yr | Vendor infrastructure | Yes | 7 or 60 days |
| Server access logs | Free | Host, outside WordPress | No | Often days |
Retention, growth, and the events worth alerting on
An activity log writes a database row per event, and on a busy site that adds up faster than people expect. Logging every page view is a performance problem wearing a security costume; logging every administrative action is the point. Configure what is captured before you configure how long it is kept.
On retention, the useful principle is that the log must reach back past a compromise you have not yet noticed. Thirty days rarely does; ninety usually does. Set a policy, apply it consistently, and remember the log itself contains personal data, so keeping it forever creates a privacy problem to solve a security one.
Alerting is where a log becomes a control rather than an archive. These six events deserve to interrupt somebody:
- An administrator account is created, which is the standard persistence mechanism after a compromise and almost never legitimate without warning.
- A user’s role is escalated, particularly to administrator, and particularly outside working hours.
- A plugin or theme is installed or activated, since this is how a backdoor arrives dressed as software.
- A theme or plugin file is edited from the dashboard, which on most production sites should never happen and is worth disabling entirely.
- An administrator’s email address changes, which is how an account takeover is completed quietly.
- A successful login from an unfamiliar country, which is noisy on some sites and decisive on others.
On tamper-evidence: if the log matters as evidence, it must not live only in the database it is recording. Either use a premium tier with external storage, or arrange for the log table to be included in an off-site backup on a schedule, so a snapshot exists somewhere an intruder cannot reach.
Related guides
Frequently asked questions
Will an activity log slow my site down?
Barely, if you log administrative actions rather than page views. The performance risk is a table that grows unchecked over years, which is a retention setting rather than a plugin problem.
Is a free log good enough?
For knowing what happened on your own site, yes. Simple History or Stream covers it. Pay when the log must be evidence, needs to alert you, or has to survive the compromise it recorded.
Can an attacker delete the log?
If it lives in your database and they have administrator access, yes, and a competent one will. This is the entire argument for external storage or a vendor-hosted log.
How long should I keep logs?
Ninety days as a working default, longer if a compliance regime specifies it. Long enough to predate a slow-discovered compromise, short enough that you are not accumulating personal data indefinitely.
Do logs contain personal data?
Yes: usernames, IP addresses, and sometimes content. That means retention limits, access controls, and a mention in your privacy documentation, and it is a reason not to keep them forever.
What if I already have a security plugin?
Check whether its log is enabled, since many sites pay for one and never switch it on. If it is present and covers user and content changes, you do not need a second plugin doing the same job.
The verdict
For most sites: Simple History, free. It records what you will actually want to read, it costs nothing, and it takes a minute to install. Having any log at all is most of the benefit.
If the log has to be evidence: WP Activity Log premium, for external database storage that keeps the record outside the site it is recording, plus alerting and reports.
If you are already buying cleanup: MalCare Fortify at $499 a year includes 60-day off-site logs, and that window is the difference between reconstructing an incident and guessing at it.
Then set one alert. Notify somebody when an administrator account is created. It is the single event most likely to mean a compromise, and an alert on it is worth more than the rest of the log combined.
