# WordPress activity log: who changed what, and when WordPress doesn't keep an activity log. If someone changed your homepage, deactivated a plugin or made themselves an administrator last month, core has no screen that tells you. You find out the hard way. A client says "the contact form stopped working", and you're left asking three people and a freelancer in another time zone who touched what. A WordPress activity log fixes that: one list of every change, with the person, the time and the thing that changed. There are two jobs here, and they need slightly different tools. One is logging what people do in wp-admin. The other, newer one is logging what AI assistants do on the site. ## What WordPress gives you natively Not much. Post and page revisions record who saved each version of the text, which covers part of "who changed this page". But menus, widgets, settings, plugin changes, user changes and logins leave no trace in core. (There's more on that gap in [WordPress revisions](/wordpress-revisions).) So for a real change log, you need a plugin. ## The two plugins most people use Both of these have 300,000+ active installs on WordPress.org as of October 2026, and both have a free version that's genuinely usable. | | WP Activity Log | Simple History | | --- | --- | --- | | Free version logs | Content, terms, widgets, menus, users, logins, settings, plugins, themes, files, database tables, some third-party plugins | Content, menus, widgets, comments, users, logins and failed logins, plugins, themes, core updates, settings, file integrity | | Default retention | 3 months, configurable (can keep forever) | 30 days (60 on installs from before 5.25.0) | | Paid extras | User sessions, reports, email/SMS/Slack alerts, external database, log mirroring | Alerts (email, Slack, Discord, Telegram), log forwarding, custom retention, export of filtered searches (basic CSV/JSON export is free) | ### WP Activity Log The heavier of the two. Each event records the date and time, the user and their role, the source IP and the object that changed. The free version already covers a lot, including WooCommerce, Yoast SEO and Gravity Forms changes. Premium adds the things agencies end up wanting: reports, notifications and storing logs in an external database. ### Simple History Lighter, and the log reads more like a timeline. It's a good fit for small sites where you mostly want to answer "who updated that plugin?" The default 30-day retention catches people out, though. If a problem surfaces six weeks later, the entry's gone unless you've changed the retention (a premium setting). Either is fine. **Install one of them on every client site you look after.** It costs nothing, and it'll end at least one argument a year. ## When the change came from an AI When Claude or ChatGPT edits your site through an MCP connection, the log usually shows the WordPress user the AI is connected as. You'll see "admin updated page Services". You won't see who asked for it, what they asked, or whether anyone checked it first. That matters as soon as more than one person asks the AI for changes. If your VA and you both work through the same connected account, the plugin log shows the same user for both of you. ## What Kitepod records When the assistant works through Kitepod, there's a second record alongside the plugin's, an audit trail for everything that goes through it. Each entry records: - who asked for the change - what changed - who approved it, and when Risky changes like code, user roles and database writes wait for a person, and the AI can't approve its own work. So the trail can tell you who asked and who signed off, which are often two different people. **The trail is hash-chained, on the site and in Kitepod.** Each entry carries a fingerprint of the one before it, so quietly editing or deleting an old entry breaks the chain. Each write is snapshotted before it happens, too, so a line in the trail can usually be reversed for up to 90 days. ```prompt List every change made on the climbing gym site this week, newest first, and tell me which ones can still be undone. ``` Your assistant can read the site's change history itself: one row per operation or change set, with what it touched, its status, and whether it can still be undone. Who approved each change lives in the trail in your Kitepod dashboard. ## Use both Kitepod's trail covers changes made through Kitepod, and nothing else. If someone logs into wp-admin and edits a page by hand, that's a job for WP Activity Log or Simple History. So the setup we'd suggest for a client site is simple. An activity log plugin for people in wp-admin, and Kitepod's audit trail for the assistant. Between them, nothing changes without a name next to it. If you sell maintenance, that pairing gives you most of the raw material for a monthly report; there's more on that in [WordPress care plans](/wordpress-care-plan). And if you're still choosing how to connect an assistant at all, start with [WordPress MCP](/wordpress-mcp). ## Finer points ### Does WordPress have a built-in activity log? No. Core keeps post and page revisions, which show who saved each version of the text. There's no built-in log of logins, plugin changes, settings or user changes. ### What's the difference between an activity log and an audit log? Mostly the name. An audit log usually implies it's protected from tampering and kept long enough to answer questions later, like a hash-chained trail. ### Is there a WordPress change log for plugin updates? Not in core. Both plugins above record plugin installs, updates and deactivations, with who did it and when. If the update went through Kitepod, its change history also shows it, with a checkpoint you can roll back to. ### How long should I keep activity logs? Long enough to cover the slowest-surfacing problem you care about. Simple History's 30-day default is short for client work; WP Activity Log's 3-month default is a more comfortable start. ### Do activity log plugins slow down WordPress? They write a row for each event, so very busy sites with lots of logins feel it more. WP Activity Log's premium version can store logs in an external database, which helps there. ### Will an activity log show what an AI assistant did? It'll show the WordPress user the AI acts as. It won't show who asked or who approved. Kitepod's audit trail records both for changes made through it. With a plugin for the people and a trail for the AI, "who changed this?" stops being a group chat.