Jaroslav Svetlik

<p>Bat Activity Log helps site owners and administrators understand what changed, who changed it, and when it happened.</p>
<p>The plugin records activity across users, content, media, comments, plugins, themes, settings, updates, privacy workflows, and other core WordPress operations. Logs are stored in a custom indexed table for fast filtering and large datasets.</p>
<h4>Key features</h4>
<ul>
<li>Track logins, logouts, failed logins, profile changes, registrations, role changes, and password updates.</li>
<li>Record post, page, media, comment, taxonomy, menu, widget, and settings activity.</li>
<li>Monitor plugin, theme, and WordPress update activity.</li>
<li>Filter logs by event type, action, severity, user, object, IP address, and date range.</li>
<li>Use saved views, quick filters, bulk actions, CSV export, and a structured log detail drawer.</li>
<li>Configure retention cleanup, privacy controls, alert rules, and scheduled reports.</li>
<li>Verify log integrity with a tamper-evident hash chain.</li>
<li>Use WP-CLI commands for stats, cleanup, export, repair, reporting, benchmarking, and integrity verification.</li>
</ul>
<h4>Event coverage</h4>
<p>Bat Activity Log currently covers:</p>
<ul>
<li>User authentication and account events</li>
<li>Content and revision events</li>
<li>Media library activity</li>
<li>Comment activity</li>
<li>Plugin and theme lifecycle events</li>
<li>Core, update, and database upgrade events</li>
<li>Settings, widget, permalink, and menu changes</li>
<li>Privacy request and erasure workflow events</li>
<li>File editor changes</li>
<li>WooCommerce events when WooCommerce is active</li>
<li>Supported form submission events for Contact Form 7, Gravity Forms, WPForms, and Elementor Pro Forms</li>
</ul>
<h4>Integrity and privacy</h4>
<p>Each log row includes integrity metadata that can be verified from the Tools screen or WP-CLI. Privacy controls include IP logging toggles, optional IP anonymization, user-agent logging controls, and WordPress personal data exporter and eraser integration.</p>
<h4>WP-CLI examples</h4>
<ul>
<li><code>wp bat-activity-log stats</code></li>
<li><code>wp bat-activity-log cleanup --days=90 --batch-size=2000</code></li>
<li><code>wp bat-activity-log export --file=/tmp/activity-log.csv</code></li>
<li><code>wp bat-activity-log repair</code></li>
<li><code>wp bat-activity-log verify-integrity</code></li>
<li><code>wp bat-activity-log report --days=7 --format=text</code></li>
<li><code>wp bat-activity-log benchmark --iterations=10 --per-page=100</code></li>
</ul>


Bat Activity Log

Track important WordPress activity with detailed audit logs, filters, alerts, reports, and integrity checks.

Piyush Asthana

<p>ActivityPilot is an activity log and audit-trail plugin for developers, agencies, and security-conscious site owners. Meaningful changes on your site — logins, content edits, plugin and theme operations, role changes, high-impact options, integrations, and more — are stored in a dedicated database table and shown in a modern admin timeline.</p>
<h4>Privacy defaults</h4>
<ul>
<li>External-service features are <strong>opt-in</strong>.</li>
<li>Geolocation (<code>ip-api.com</code>) is <strong>disabled by default</strong> (<code>enable_geo = 0</code>).</li>
<li>Outbound webhooks (Slack/Discord/Teams/custom URL) are <strong>disabled by default</strong> until you enable them and provide destination URLs.</li>
<li>The plugin does not send data to third-party services unless you explicitly enable and configure those features.</li>
</ul>
<h4>Why use this plugin?</h4>
<ul>
<li><strong>Custom tables</strong> — logs live in <code>{prefix}apwpm_activity_logs</code> (not post meta) with indexes for fast queries.</li>
<li><strong>Modern admin UI</strong> — dashboard, timeline, filters, search, pagination, exports, dark mode, and keyboard shortcuts.</li>
<li><strong>Security-first</strong> — capability checks, REST nonces, prepared SQL, output escaping, and optional sudo mode for destructive actions.</li>
<li><strong>Break detection</strong> — spots error spikes and surfaces recent risky changes.</li>
<li><strong>Extensible</strong> — REST API (<code>activitypilot/v1</code>), hooks, custom event registry, and PSR-3 adapter.</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Activity logging for logins, posts, plugins, themes, users, roles, and important site options</li>
<li>Timeline view with avatars, severity colors, and structured context</li>
<li>Filters by user, action, object type, severity, date range, status, assignee, and search</li>
<li>CSV and JSON exports; daily retention pruning via cron</li>
<li>Email alerts when break detection finds unusual error activity</li>
<li>Workflow: acknowledge, resolve, snooze, assign, and comment on events</li>
<li>Smart insights: bursts, off-hours access, role escalation, and statistical spikes</li>
<li>Optional rollback for supported change types (sudo-gated)</li>
<li>Analytics heatmap, hour-of-day chart, and top users</li>
<li>Scheduled HTML digest reports (daily, weekly, monthly)</li>
<li>Multisite support with per-site tagging and network overview</li>
<li>Hash-chain integrity verification (optional)</li>
<li>File integrity monitoring, IP throttle, PII redaction, GDPR export/erase helpers</li>
<li>Integrations: WooCommerce, ACF, popular form builders, SEO plugins, page builders</li>
<li>Optional outbound webhooks (Slack, Discord, Microsoft Teams, generic URL)</li>
<li>WP-CLI: <code>wp apwpm list|count|verify|prune|purge|export|digest|scan-files</code></li>
</ul>
<h4>For developers</h4>
<p>Log custom events from your code:</p>
<pre><code>APWPM_Logger::log( array( 'action_type' => 'my_event', 'description' => 'Something happened' ) );
</code></pre>
<p>Filter hooks include <code>apwpm_skip_log</code>, <code>apwpm_pre_insert_row</code>, and <code>apwpm_register_event_types</code>. The shorter <code>ap_*</code> hook names from earlier builds are still fired for backward compatibility.</p>
<h3>External services</h3>
<p>This plugin can connect to third-party services <strong>only when you enable the related feature</strong> and, for webhooks, when you provide URLs.</p>
<h4>IP geolocation (optional)</h4>
<p>When <strong>Enable geolocation</strong> is on, the plugin may send the visitor IP address to <a href="http://ip-api.com/" rel="nofollow ugc">ip-api.com</a> to resolve country and city. No API key is required. Results are cached in WordPress transients (about 24 hours). See the <a href="https://ip-api.com/docs/legal" rel="nofollow ugc">ip-api privacy policy</a> for their terms.</p>
<ul>
<li>Data sent: IP address (in the request URL).</li>
<li>When: On log insert for events that include an IP, if geo is enabled and not already set.</li>
<li>Purpose: Display country/city on timeline rows and detect logins from new countries.</li>
</ul>
<h4>Outbound webhooks (optional)</h4>
<p>When webhooks are enabled and URLs are saved in settings, the plugin sends HTTP POST requests to <strong>your</strong> endpoints (for example Slack, Discord, Microsoft Teams, or a custom URL) when qualifying events occur.</p>
<ul>
<li>Data sent: Event title, description, severity, site name, and related metadata you configure to receive.</li>
<li>When: After an event is logged that meets your minimum severity threshold.</li>
<li>Purpose: Notify external chat or monitoring systems.</li>
<li>Services/endpoints: Slack, Discord, Microsoft Teams, or any custom HTTPS endpoint that you explicitly configure.</li>
<li>Terms/privacy (when using those services):<br />
Slack: https://slack.com/terms-of-service , https://slack.com/privacy-policy<br />
Discord: https://discord.com/terms , https://discord.com/privacy<br />
Microsoft Teams (Microsoft): https://www.microsoft.com/servicesagreement , https://privacy.microsoft.com/privacystatement</li>
</ul>
<p>Webhook delivery is fully optional and disabled by default. No webhook requests are sent until you enable webhooks and provide at least one destination URL.</p>
<p>The plugin does not include bundled third-party API keys. Geolocation and webhooks are optional and disabled by default until configured by a site administrator.</p>


ActivityPilot

Track, visualize, and analyze admin and user activity in a timeline UI with break detection, workflows, REST API, and exportable audit logs.

Bat Activity Log vs ActivityPilot