Get Started

Audit Logging (Pro)

Comprehensive activity tracking and security event logging for compliance and forensic analysis.

  • Intermediate
  • 30 min read
  • Applies to 1.2.1 Pro
  • Updated November 2025

Written for 1.2.1 Pro. It is being checked against 2.0, so a screen or a setting may sit somewhere else. Tell support if something does not match.

Overview

Audit Logging provides comprehensive tracking of user activities, security events, and system changes. Essential for compliance, security monitoring, troubleshooting, and forensic analysis.

Why Use Audit Logging?

✓ Security Monitoring
Detect suspicious activities, brute force attempts, and unauthorized access in real-time.

✓ Compliance Requirements
Meet HIPAA, SOC 2, PCI-DSS, ISO 27001 audit trail requirements.

✓ User Accountability
Track who did what and when with detailed forensic trails.

✓ Troubleshooting
Diagnose login issues, permission problems, and configuration errors quickly.

Accessing Audit Logs

Navigate to:

WordPress Admin → Settings → Attributes User Access → Audit Log

Understanding Log Entries

Log Entry Anatomy

Each audit log entry contains comprehensive details:

FieldDescriptionExample
TimestampWhen event occurred (UTC)2025-11-06 14:30:15
UserWho performed actionjohn.doe
Event TypeCategory of eventLogin Attempt
ActionSpecific action takenSuccessful Login
IP AddressSource IP address192.0.2.100
User AgentBrowser/device infoChrome 118.0
DetailsAdditional contextRole: Administrator
ResultSuccess/Failure statusSuccess

Example Log Entries

Successful Login:

Timestamp: 2025-11-06 09:15:23
User: admin
Event Type: Authentication
Action: Login Success
IP Address: 203.0.113.50
User Agent: Mozilla/5.0 (Windows NT 10.0) Chrome/118.0
Details: Role: Administrator, 2FA: Enabled
Result: Success

Failed Login Attempt:

Timestamp: 2025-11-06 14:42:10
User: admin (attempted)
Event Type: Authentication
Action: Login Failed
IP Address: 192.0.2.75
User Agent: Python-requests/2.28
Details: Reason: Invalid password (Attempt 3 of 5)
Result: Failed

Account Locked:

Timestamp: 2025-11-06 14:45:33
User: admin
Event Type: Security
Action: Account Locked
IP Address: 192.0.2.75
User Agent: Python-requests/2.28
Details: Reason: 5 failed login attempts in 10 minutes
Result: Locked

Event Types and Categories

Authentication Events

Login/Logout tracking:

✓ Login Attempt (Success)
✓ Login Attempt (Failed)
✓ Logout
✓ Password Change
✓ Password Reset Request
✓ 2FA Verification Success
✓ 2FA Verification Failed
✓ 2FA Code Sent
✓ Session Expired
✓ Forced Logout

Security Events

Threat detection and prevention:

✓ IP Address Blocked
✓ IP Address Unblocked
✓ Failed Login Threshold Reached
✓ Account Locked
✓ Account Unlocked
✓ Suspicious Activity Detected
✓ Brute Force Attempt Detected
✓ Rate Limit Exceeded
✓ VPN/Proxy Detected

User Management Events

User lifecycle tracking:

✓ User Created
✓ User Deleted
✓ User Role Changed
✓ User Profile Updated
✓ User Activated
✓ User Deactivated
✓ User Email Changed
✓ User Permissions Modified

Administrative Actions

Configuration changes:

✓ Settings Changed
✓ Plugin Activated
✓ Plugin Deactivated
✓ Plugin Settings Modified
✓ License Key Validated
✓ Maintenance Mode Enabled
✓ Broadcast Email Sent
✓ Security Policy Updated

Content Events

Content modification tracking:

✓ Post Published
✓ Post Deleted
✓ Page Modified
✓ Media Uploaded
✓ Media Deleted
✓ Comment Approved
✓ Comment Deleted

Filtering and Searching Logs

Filter by Date Range

Preset ranges:

• Last 24 Hours - Recent activity
• Last 7 Days - Weekly review
• Last 30 Days - Monthly audit
• Last 90 Days - Quarterly compliance
• Custom Date Range - Specific investigation

Custom date range:

From: [2025-11-01] [00:00]
To:   [2025-11-06] [23:59]
[Apply Filter]

Filter by Event Type

Select categories:

☑ Authentication Events
☑ Security Events
☐ User Management
☐ Administrative Actions
☐ Content Events

Quick security filters:

• Failed Logins Only
• Account Lockouts
• IP Blocks
• Suspicious Activity
• 2FA Events

Filter by User

Search options:

By username:

User: john.doe
[Search]

By role:

User Role: [Administrator ▼]
Shows all administrator activity

By user ID:

User ID: 42
[Search]

Filter by IP Address

Single IP search:

IP Address: 192.0.2.100
[Search]

IP range search (CIDR):

IP Range: 192.0.2.0/24
Shows all activity from this network

Quick IP filters:

• Show only blocked IPs
• Show only external IPs (non-local)
• Show only VPN/Proxy IPs
• Show my IP only

Filter by Result

Result filters:

Show:
○ All Events
○ Successful Only
○ Failed Only
○ Suspicious Activity Only

Advanced Search

Combine multiple filters:

Date Range: Last 30 days
Event Type: Authentication Events
User: All users
Result: Failed Only
IP: External IPs only

Result: All failed login attempts from external IPs in last 30 days

Exporting Audit Logs

Export Formats

Available formats:

  • CSV (Excel compatible)
  • JSON (API integration)
  • PDF (Audit reports)
  • XML (System integration)

CSV Export

Step-by-step:

1. Apply filters

Date Range: Last 90 days
Event Type: All security events
User: All users

2. Select export format

Export → CSV Format

3. Choose columns

☑ Timestamp
☑ User
☑ Event Type
☑ Action
☑ IP Address
☑ Result
☐ User Agent (optional)
☐ Extended Details (optional)

4. Download file

Filename: audit-log-2025-11-06.csv
Download to: [Your Computer]

PDF Audit Report

Generate compliance-ready reports:

1. Configure report

Report Title: Q4 2025 Security Audit
Date Range: 2025-10-01 to 2025-12-31
Include: All security events
Group By: Event Type

2. Customize appearance

☑ Include summary statistics
☑ Include charts/graphs
☑ Include executive summary
☑ Include recommendations

3. Generate PDF

[Generate Report]
Preview → Download

Automated Export

Schedule regular exports:

Frequency: Weekly
Day: Monday 9:00 AM
Format: CSV
Email To: security@company.com
Retention: Keep for 90 days

Compliance and Retention

Retention Policies

Configure log retention:

Compliance StandardMinimum RetentionRecommended
HIPAA6 years7 years
SOC 21 year2 years
PCI-DSS1 year (3 months accessible)2 years
ISO 27001Varies by policy2 years
GDPRAs long as necessary1-3 years

Retention Configuration

User Access → Security → Log Retention. The default is 30 days. Entries older than that are deleted by a daily scheduled task.

There is no archiving. Older versions of this page described automatic archiving to an encrypted ZIP, optionally on S3 or Azure, and a configurable archive location. None of that exists — nothing in the plugin has ever written an archive.

The distinction matters if you keep logs for compliance: entries past the retention period are deleted, not stored elsewhere. If you need them kept, export them before they age out, or raise the retention period.

Deletion depends on WP-Cron. On a site where WP-Cron is disabled in favour of a system cron, make sure the scheduled task actually runs, or the table grows past the retention period the screen displays.

Using Logs for Security Analysis

Detecting Brute Force Attacks

Look for patterns:

Event: Multiple failed login attempts
User: Same username (often "admin")
IP: Single IP or small range
Timeframe: Short duration (minutes)
User Agent: Often automated tools

Action: Block IP, alert admin

Example brute force log:

14:42:10 - Login Failed - admin - 192.0.2.75 (Attempt 1/5)
14:42:12 - Login Failed - admin - 192.0.2.75 (Attempt 2/5)
14:42:15 - Login Failed - admin - 192.0.2.75 (Attempt 3/5)
14:42:18 - Login Failed - admin - 192.0.2.75 (Attempt 4/5)
14:42:20 - Login Failed - admin - 192.0.2.75 (Attempt 5/5)
14:42:21 - Account Locked - admin - 192.0.2.75
14:42:22 - IP Blocked - 192.0.2.75 (Auto-blocked: Brute force)

Identifying Compromised Accounts

Warning signs:

✓ Login from unusual location/IP
✓ Login at unusual time (3 AM)
✓ Multiple logins from different locations simultaneously
✓ Sudden change in activity patterns
✓ Access to unusual resources
✓ Failed privilege escalation attempts

Monitoring Administrative Changes

Track critical changes:

Event: Settings Changed
Details: Password policy modified
Changed: Min length: 12 → 8 characters
User: john.doe
Timestamp: 2025-11-06 15:30

Action: Investigate unauthorized policy weakening

Alert Notifications

Real-Time Alerts

Configure email alerts:

Failed login threshold:

Trigger: 5 failed login attempts in 10 minutes
Action: Send email to admin
Email: security@company.com
Include: User, IP, timestamp, user agent

Successful admin login:

Trigger: Administrator role login
Action: Send email notification
Email: admin@company.com
Include: IP address, location, device

IP block:

Trigger: IP address blocked
Action: Send email alert
Email: security@company.com
Include: Reason, IP, associated events

Security policy change:

Trigger: Security settings modified
Action: Send email to senior admin
Email: cto@company.com
Include: What changed, who changed it, when

Best Practices

Review Logs Regularly
Schedule weekly log reviews. Look for patterns, anomalies, and security events.

Export Before Retention Expiry
Export important logs before automatic deletion. Save for compliance audits.

Use Filters Effectively
Start broad, then narrow with filters. Don't wade through thousands of entries manually.

Correlate with Other Logs
Cross-reference with server logs, firewall logs, and application logs for complete picture.

Automate Monitoring
Set up automatic alerts for critical events. Don't rely on manual checks alone.

Troubleshooting

Logs Not Recording

Solutions:
  • Verify audit logging is enabled in settings
  • Check database table exists (wp_attrua_audit_log)
  • Verify sufficient disk space
  • Check file permissions on log directory
  • Review PHP error logs for database errors

Cannot Export Logs

Solutions:
  • Check PHP memory limit (increase to 256M+)
  • Verify write permissions on export directory
  • Try smaller date range
  • Check for browser popup blockers
  • Try different export format

High Disk Usage

Solutions:
  • Reduce retention period
  • Enable automatic archiving
  • Archive and delete old logs manually
  • Filter events to log (reduce verbosity)
  • Store archives on external storage

Related articles

Something missing or out of date? Tell support.