Andy Whalen

Creates a log file for network/multisite super admin actions.
The following actions are logged for Super Admin users. WordPress action names are listed in parenthesis:
<ul>
<li>change network settings (update_site_option)</li>
<li>grant super admin privileges (granted_super_admin)</li>
<li>revoke super admin privileges (revoked_super_admin)</li>
<li>upgrade blog (wpmu_upgrade_site)</li>
<li>add blog (wpmu_new_blog)</li>
<li>set blog archived (archive_blog/unarchive_blog)</li>
<li>set blog deleted (make_delete_blog/make_undelete_blog)</li>
<li>set blog mature (mature_blog/unmature_blog)</li>
<li>set blog spam (make_spam_blog/make_ham_blog)</li>
<li>delete blog (delete_blog)</li>
<li>delete user (wpmu_delete_user)</li>
<li>delete user (deleted_user)</li>
<li>change other user’s settings (edit_user_profile_update) [NOTE: doesn’t show diff]</li>
<li>change blog setting (updated_option) [NOTE: may occasionally log annoyingly large diffs]</li>
</ul>
The following actions are logged for ANY user:
<ul>
<li>login (wp_login)</li>
<li>logout (wp_logout)</li>
<li>new user (user_register)</li>
</ul>
Some actions that change data will show what the value was before and after.
Below is an example of a log entry when the user ‘smith’ has changed the Network site name from “WP Local Network” to “WP Local Networks”:
<pre><code>[Tue, 03 Sep 2013 13:45:49 +0000] [smith:1] [update_site_option] [1] [site_name] [(WP Local Network)->(WP Local Networks)] [127.0.0.1] </code></pre>
Each line in the log file will roughly follow the below example. Individual actions may log slightly different information, but the DATETIME, USERNAME, USER_ID, ACTION, and IP_ADDRESS sections should always be populated.
<pre><code>[DATETIME] [USERNAME:USER_ID] [ACTION] [AFFECTED_OBJECT_ID] [DATA_TITLE_OR_KEY] [(VALUE_BEFORE)->(VALUE_AFTER)] [IP_ADDRESS] </code></pre>

Observer

Creates a log file for network/multisite super admin actions.

Dmitri Martin

Traffic Monitor gives you full visibility into how people and bots are hitting your site.
Unlike bloated analytics and security plugins, Traffic Monitor focuses on logging raw request data that you control. You’ll know which pages are cached, which bots are visiting, where users are coming from, and how many requests are tied to each IP/browser combination.
Perfect for developers, marketers, and site owners who want fast insights—without handing over their traffic data.
<h3>What Makes It Different</h3>
<ul>
<li>✅ Logs requests for both cached and non-cached pages</li>
<li>✅ Lets you export raw traffic logs as raw CSV for your own analysis</li>
<li>✅ Identifies repeat ad clicks for spotting potential click fraud</li>
<li>✅ Reveals which bots are hitting your site, so you can block them elsewhere (example: Cloudflare)</li>
<li>✅ Tracks IP address, fingerprint, device type, cache status, response code, and more</li>
<li>✅ Displays referrer URLs and query strings</li>
<li>✅ Records the original source of requests by the same visitor as they surf your website</li>
<li>✅ Doesn’t auto-block or inject junk—just clean, useful data</li>
<li>✅ Works great with Cloudflare, caching plugins, and reverse proxies</li>
</ul>
<h3>Key Features</h3>
<ul>
<li>Logs every page request, including IP address, referrer, user-agent, browser, device, method, and more.</li>
<li>Detects cached traffic even if served by Cloudflare, your web host, or a plugin.</li>
<li>Identifies bot traffic by bot name and category.</li>
<li>View click IDs like gclid and fbclid from ad platforms like Google and Meta.</li>
<li>Records repeat ad clicks to detect potential click fraud.</li>
<li>Bulk delete or export logs with one click.</li>
<li>Search, sort, and drill into data from your dashboard.</li>
<li>Built-in help tabs with definitions, setup help, and troubleshooting.</li>
</ul>
<h3>Use Cases</h3>
<ul>
<li>Debug integrations instantly: Know exactly what URLs are being hit, by which devices, and with what parameters. No guesswork.</li>
<li>Spot caching gaps: See which pages are served from cache and which aren’t, even with Cloudflare or plugin-level caching.</li>
<li>Understand real-world traffic: Track entry pages, referrers, devices, and browsers—whether human or bot.</li>
<li>Catch click fraud signals: Identify repeat ad clicks tied to the same IP/user agent fingerprint or session, even if served from cache.</li>
<li>Audit referrers: View exactly which websites or campaigns are driving traffic (including query strings).</li>
<li>Filter out noise: Use bot labels and device types to focus only on human traffic when analyzing patterns.</li>
</ul>

Traffic Monitor

Lightweight traffic logger for WordPress analytics. View, filter, and export page request data; monitor caching; detect bots; and spot click fraud.

Observer vs Traffic Monitor