WP Manifestindependent plugin directory
manifest / security / log-changes

Log Changes

for logging changes on WordPress sites with multiple admins

by Barry Schoedel · github.com/schoedel-learn/log-changes · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/schoedel-learn/log-changes/archive/refs/heads/main.zip

Readme

Log Changes - WordPress Plugin

A comprehensive WordPress plugin for tracking all changes to your site with detailed information about what changed, when, and who made the changes.

Description

Log Changes is designed for WordPress sites with multiple administrators who need detailed audit trails. Unlike simpler logging plugins, this captures comprehensive information including old and new values, making it perfect for accountability and troubleshooting.

Features

Comprehensive Tracking

  • Posts & Pages: Create, update, delete, and status changes
  • Users: Registration, profile updates, deletions, and role changes
  • Authentication: Successful logins, failed login attempts, and logouts (with time, user, and IP)
  • Plugins: Activation, deactivation, installation, deletion, and updates
  • Themes: Theme switches, activations, and updates
  • Media: Uploads and deletions with file type information
  • Menus: Navigation menu creation, updates, and deletions
  • Widgets: Widget updates and changes
  • Customizer: Theme customizer changes
  • Settings: WordPress options and settings changes

E-Commerce Tracking

  • WooCommerce: Product creation/editing/deletion, order creation (purchases), order status changes (including returns/refunds)
  • SureCart: Purchase tracking, order status changes

Plugin-Specific Integrations

  • Fluent Forms: Form creation, editing, and deletion
  • Fluent CRM Pro: Contact creation, updates, and deletion
  • Fluent Support: Ticket creation and updates
  • Fluent Boards: Board and task creation
  • Slim SEO: SEO meta data updates
  • Spectra: Design imports
  • Code Snippets: Code snippet creation, editing, and deletion

Detailed Information

Each change log entry includes:

  • Timestamp (when the change occurred)
  • User information (who made the change)
  • Action type (created, updated, deleted, etc.)
  • Object type (post, user, plugin, etc.)
  • Object name and ID
  • Detailed description
  • Old and new values (for updates and changes)
  • IP address
  • User agent (browser information)

Smart Detection

  • Only logs user-initiated changes through the UI
  • Automatically skips automated changes (WP-Cron, WP-CLI, system processes)
  • Skips transients and frequently-changing temporary data
  • Prevents log bloat from automated processes

Export and Cleanup

  • Export to CSV: Download logs as CSV for backup or analysis in Excel/Google Sheets
  • Export & Delete: Export logs to CSV then delete them from database to free up space
  • Date Range Filtering: Filter logs by date range for targeted operations
  • Automatic Cleanup: Logs older than 21 days are automatically deleted daily
  • Bulk Operations: Export or delete multiple logs at once based on filters

User-Friendly Interface

  • Clean, organized admin interface
  • Advanced filtering by action type, object type, user, and date range
  • Search functionality across descriptions and object names
  • Pagination for large log sets
  • Expandable details view for old/new values
  • Clickable badges for quick filtering
  • One-click export to CSV
  • Confirmation dialogs for destructive actions

Installation

Standard Installation

  1. Download the plugin files
  2. Upload the log-changes folder to /wp-content/plugins/
  3. Activate the plugin through the WordPress admin Plugins menu
  4. Access logs via the "Change Log" menu item

Development Installation

cd /wp-content/plugins/
git clone https://github.com/schoedel-learn/log-changes.git
cd log-changes

Then activate through WordPress admin.

Configuration

Settings Page

Access settings at Settings → Change Log Settings

Option Logging Controls:

  • Control which WordPress option changes are logged
  • Exclude noisy automated options (asset versions, hit counters, session data, etc.)
  • Allowlist critical settings to always log (blogname, siteurl, etc.)
  • Control whether to log wp_user_roles (often updated by plugins automatically)
  • One pattern per line with wildcard support (e.g., *_transient* matches all transients)

Logging Controls:

  • Enable/disable logging by content type
  • Toggle logging for posts, users, plugins, themes, media, menus, and widgets
  • Fine-tune what gets tracked based on your needs

Cleanup Settings:

  • Adjust automatic cleanup period (default: 21 days, range: 1-365 days)
  • Manually trigger cleanup to delete old logs immediately
  • Logs older than the configured period are automatically deleted daily

Developer Filters

Programmatically exclude options:

add_filter( 'log_changes_option_exclusions', function( $exclusions ) {
    $exclusions[] = 'my_plugin_cache_key';
    $exclusions[] = 'another_noisy_option';
    return $exclusions;
} );

Control whether specific option should log:

add_filter( 'log_changes_should_log_option', function( $should_log, $option_name, $old_value, $new_value ) {
    // Skip if value didn't actually change
    if ( $old_value === $new_value ) {
        return false;
    }

    // Skip specific option based on custom logic
    if ( $option_name === 'my_special_option' && some_condition() ) {
        return false;
    }

    return $should_log;
}, 10, 4 );

Usage

Viewing Logs

Navigate to Change Log in the WordPress admin menu to view all tracked changes.

Filtering Logs

Use the filter dropdowns and inputs to narrow results by:

  • Action type (created, updated, deleted, etc.)
  • Object type (post, user, plugin, etc.)
  • User (who made the change)
  • Date range (from and to dates)
  • Search terms (in descriptions and object names)

Exporting Logs

Export to CSV:

  1. Apply filters to select the logs you want to export (or export all)
  2. Click "Export to CSV" button
  3. CSV file downloads automatically with timestamp in filename
  4. Open in Excel, Google Sheets, or any spreadsheet application

Export & Delete:

  1. Apply filters to select logs you want to archive and remove
  2. Click "Export & Delete" button
  3. Confirm the action in the dialog
  4. CSV downloads and selected logs are deleted from database
  5. Success message shows number of deleted entries

Note: Logs are automatically cleaned up based on the configured cleanup period (default: 21 days, configurable in Settings). Use export before they're deleted if you need historical data.

Viewing Details

Click "Show Details" on any log entry to see:

  • Old and new values for changes
  • IP address of the requester
  • User agent information

Requirements

  • WordPress 5.0 or higher
  • PHP 7.2 or higher
  • MySQL 5.6 or higher / MariaDB 10.0 or higher

Compatibility

Tested with:

  • WordPress 6.8+
  • PHP 8.2+
  • MariaDB 11.8+

Works with:

  • Multisite installations
  • All standard WordPress post types
  • Custom post types
  • WooCommerce - Product and order tracking
  • SureCart - Purchase and order tracking
  • Fluent Forms - Form management tracking
  • Fluent CRM Pro - Contact management tracking
  • Fluent Support - Ticket tracking
  • Fluent Boards - Board and task tracking
  • Slim SEO - SEO meta tracking
  • Spectra - Design import tracking
  • Code Snippets - Snippet management tracking
  • Membership plugins
  • Other standard WordPress plugins

Database

The plugin creates a single custom table {prefix}_change_log with the following structure:

  • id - Unique identifier
  • timestamp - When the change occurred
  • user_id - WordPress user ID (if applicable)
  • user_login - Username or system identifier
  • action_type - Type of action performed
  • object_type - Type of object changed
  • object_id - ID of the object
  • object_name - Name of the object
  • description - Human-readable description
  • old_value - Previous value (JSON for complex data)
  • new_value - New value (JSON for complex data)
  • ip_address - IP address of requester
  • user_agent - Browser/client information

Automatic Cleanup

The plugin automatically deletes logs older than the configured period to prevent database bloat:

  • Runs daily via WordPress cron
  • Default cleanup period: 21 days (configurable in Settings: 1-365 days)
  • Deletes logs with timestamp older than the configured period
  • Logs the cleanup action itself for audit trail
  • Manual cleanup also available in Settings page

Export logs before they're automatically deleted if you need to retain historical data.

Privacy

All data is stored locally in your WordPress database. No data is sent to external services. The plugin logs:

  • User actions and identifiers
  • IP addresses
  • User agent strings
  • Content changes

Logs are automatically deleted after 21 days. Exported CSV files are downloaded to your local machine and not stored on the server.

Ensure your privacy policy discloses this tracking if required by your jurisdiction.

Security

This plugin is built with security as a top priority. See our Security Policy for details.

Security Features

  • Input Validation: All user inputs are sanitized using WordPress functions
  • Output Escaping: All output is properly escaped to prevent XSS
  • SQL Injection Prevention: Uses prepared statements with wpdb->prepare()
  • Access Control: Only users with manage_options capability can view logs
  • Nonce Verification: All forms and AJAX requests are protected with nonces
  • IP Spoofing Protection: Validates IP addresses against server variables
  • No External Calls: All data stays in your WordPress database

Security Scanning

This plugin is regularly scanned for security vulnerabilities:

  • CodeQL: Automated code analysis for security issues
  • WordPress Coding Standards: Follows WordPress best practices
  • Dependabot: Automatic dependency vulnerability alerts
  • Manual Reviews: Regular security audits

Reporting Security Issues

Found a security vulnerability? Please report it responsibly:

  • GitHub Security Advisories: Report privately (preferred)
  • Email: security@schoedel.design

See our Security Policy for more information.

Uninstallation

When you delete the plugin through WordPress admin, it will:

  1. Remove the custom database table
  2. Delete all stored logs
  3. Remove all plugin options

This ensures a clean removal with no leftover data.

Performance

The plugin is optimized for minimal performance impact:

  • Efficient database queries with proper indexing
  • Automatic exclusion of transients and temporary data
  • Batch operations where appropriate
  • Minimal memory footprint

Development

File Structure

log-changes/
├── log-changes.php          # Main plugin file
├── includes/
│   └── admin-page.php       # Admin interface template
├── assets/
│   ├── css/
│   │   └── admin.css        # Admin styles
│   └── js/
│       └── admin.js         # Admin JavaScript
├── uninstall.php            # Clean uninstall script
├── readme.txt               # WordPress.org readme
├── README.md                # This file
└── LICENSE                  # MIT License

Contributing

Contributions are welcome! We appreciate your help in making this plugin better.

Before contributing, please read:

Quick start: Contributions are welcome! Please read our Contributing Guidelines before submitting pull requests.

Quick Start:

  1. Fork the repository
  2. Create a feature branch (git checkout -b feature/amazing-feature)
  3. Make your changes following WordPress Coding Standards
  4. Test thoroughly (see CONTRIBUTING.md)
  5. Commit your changes (git commit -m 'feat: add amazing feature')
  6. Push to the branch (git push origin feature/amazing-feature)
  7. Open a Pull Request

Areas where we need help:

  • 🐛 Bug fixes
  • 📝 Documentation improvements
  • 🌐 Translations
  • ✨ New features
  • 🧪 Testing and QA
  • 🔒 Security improvements
  1. Make your changes following WordPress coding standards
  2. Test thoroughly
  3. Commit your changes (git commit -m 'Add amazing feature')
  4. Push to the branch (git push origin feature/amazing-feature)
  5. Open a Pull Request

Important Notes:

Coding Standards

This plugin follows:

  • WordPress Coding Standards
  • WordPress Plugin Best Practices
  • WordPress Security Best Practices
  • PHPCS with WordPress ruleset

Run code quality checks:

composer install
composer run-script phpcs  # Check coding standards
composer run-script phpcbf # Fix coding standards automatically

Read the full README on GitHub →