How To Safeguard WordPress Site Using WP Activity Log?

Are you aware of as to what goes behind the scenes.. I mean what users do in your WordPress website backend?

Have you thought about your website security seriously?

If not, you must start using the WP Activity Log plugin.

But before digging deeper into WP Activity Log plugin, let’s understand why security is so important.

Why security is your topmost priority?

Let’s say you have asked your own developer to tweak some code; or your blogger to edit a post. You may even have hired a person from outside to do the job.

Now, how will you track these?

• Is the developer committed to the job (starts and completes on time)?
• Has the blogger edited the post more than he should?
• Has the hired person hacked into your website pages when he shouldn’t?
• Is it worth spending the price considering the time taken by the individual person?

and many more cases needs to be tracked…maybe beyond hundred.

That’s the reason why monitoring every single user activity is of utmost importance and that’s why the WP Activity Log WordPress plugin is a must.

A sneak peak into WP Activity Log

The WP Activity Log plugin is the most comprehensive audit log plugin. Being around for almost five years and 60,000+ active installs, it’s a popular choice amongst WordPress users.

It keeps an audit log of everything that happens on your WordPress website as well as WordPress multisites.

Be it yourself, your developers, bloggers, temporary users or outsourced personnel , WP Activity Log plugin keeps a complete watch on the user activity and records the changes in a WordPress activity log, that is available on your WordPress backend.

Blog post title change, password change, change of user role, what time the user performed a task, etc.. all gets recorded.

The plugin is free to use. Though, there is a premium edition available to enhance the functionality of the plugin.

Four benefits of having a WordPress Audit Trail (Using WP Activity Log)

An audit trail, also commonly known as a WordPress audit log, is a security-relevant log in which a chronological record of a sequence of changes and activities are recorded.

Tracking multiple WordPress users’ activities

Someone has overwritten someone else’s change or someone changed the content of the main page; someone else changed the main menu or its location.

When you try to find out what exactly happened no one takes responsibility. Thus, having a audit trail lets you know exactly which user performed which task at what time.

Easy WordPress troubleshooting

Keeping a record of all the changes that took place in WordPress audit trail will make troubleshooting very easy. You can use the WordPress audit trail to go back through the changes and identify those that might have led to the existing problem.

Identify suspicious behaviour & malicious attacks

Numerous failed login attempts and several requests that generate 404 errors are all signs of a WordPress website attack. Recording such activities will alert you via email (need to configure it) and you can easily thwart the attack before its occurence.

Meeting all legal & regulatory compliance requirements

All WordPress websites used for online business have to be compliant to several legal and regulatory compliance requirements, such as PCI DSS. One thing that all of these requirements have in common is the requirement to keep an audit trail of everything that is happening on your WordPress website.

Warning…Notice…100+ security alerts

Pages, custom post types, comments, plugins…be it any category, WP Activity Log plugin provides alerts for each of these and it’s severity – warning , notice or high.

Listed are some common and most widely seen alerts you must keep a track on-

• New user is created via registration or by another user
• A user logs in to WordPress for the first time
• User changes the role, password or other profile settings of another user
• User uploads or deletes a file, changes a password or email address
• User installs, activates, deactivates, upgrades or uninstalls a plugin / theme
• User creates / modifies a post, page, category or a custom post type
• User adds, moves, modifies or deletes a widget
• User changes WordPress settings such as permalinks or administrator notification email
• Failed login attempts

and many more…

If you own a multi user WordPress blog or website, or a WordPress multisite network installation you can use WP Activity Log plugin to monitor your users’ activity and productivity.

With WP Activity Log WordPress plugin you can monitor:

• When WordPress users log in or out
• From where WordPress users are logging in
• Users who created, published, modified a blog post, page or a custom post
• Users who moves content to trash or permanently deletes it
• Users who modify WordPress widgets
• User who upload or delete any sort of files

and much more…

You can view complete list of all changes the WP Security plugin keeps a record of in the complete list of WordPress security alerts.

How to secure websites from temporary users?

Let’s say you want to give admin access or editor access to outsourced people or your own team members to perform some necessary tweaks for you-

• Developer to tweak some line of code
• Blogger or author to write, edit or review post
• Customers to reach out to you
• Manager to monitor store activities
• Marketers to design offers, make coupons..

and many more…

But for security reasons, you want to delete their account once the job is done. Right?

And what’s the easy and faster way to do that?

It’s the Temporary Login Without Password plugin from StoreApps.

You can choose when the login expires, as well as the user role of the temporary account.

Top benefits of using this plugin

• No need of remembering or storing passwords
• Getting rid of short-long, special characters password creation restrictions
• Self expiring temporary login links
• Safe and secure
• Unlimited Account creation

Are temporary users a threat to website? (Not anymore)

Temporary users links expire as you wish but what about security when they are using the backend area?

Is this what you are thinking?

Then, WP Activity Log is a great solution in such cases.

Using WP Activity Log with Temporary Login Without Password is the best way to secure your website from temporary users.

You can easily keep a track on what temporary users are doing on your website in real-time.

Whatever alerts WP Activity Log records for users, the same can be recorded for temporary users as well – title change, time spent, webpages browsing, comments, etc.

It’s like your website is having a double layer of security:

• Temporary account which means no further threat from these users after login expiry.
• Tracking of each user activity on WordPress website during their account activation period.

WP Activity Log installation, setup, use…

After downloading the plugin, you need to install and start using it. Here’s how :

Setup and installation

Installing WP Activity Log is very simple. Download the plugin from the WordPress repository. Install and activate. The plugin adds its own menu called “Audit Log” just below the WP Dashboard and starts keeping a log of every change automatically.

Usage

Audit Log Viewer

The Audit Log Viewer is the first option in the menu. Every enabled and triggered alert can be viewed here. You can even sort the alerts list based upon all of the displayed criteria including code, date, username and source IP.

Enable/Disable Alerts

This forms the core part of the plugin. It lets you choose which user activities you want to track. There are over 100 activities to choose from, broken down into various categories for easier navigation. All alerts are enabled by default.

You’ll be able to enable or disable each alert depending on your specific needs. Each alert has its own specific code, type (notice, warning and critical) and description.

Settings

The settings tab is divided into three sections – General, Audit Log and Exclude Objects.

General

Under General, you can set from name and email details.

Next up is an option to add the most recent 5 alerts to your WordPress Dashboard and some Proxy / Firewall options that will adjust how the WP Activity Log plugin retrieves a users IP address when running behind a web application firewall.

By default only WordPress administrators can view the alerts or manage the plugin but this can be changed and access can be granted to specific roles and users by simply adding the information in the ‘Can Manage Plugin’ settings.

Audit Log

Under Audit Log, you have option to manage your alert database – how much to retain.

What follows next is to control how the Audit Log is displayed – automatic or manual refresh, displaying specific columns and the time format.

Exclude

The exclude tab allows you exclude specific users and roles from monitoring as well as any activity from a specific IP address and custom fields changes.

Enhancing the power of WP Activity Log (Must have Premium Functionality)

Along with the free version, the WP Activity Log premium edition offers the following functionality:

Email Notifications

Logging into WordPress every time to check alerts is troublesome.
Hence, this feature allows you to get notified via email when important changes happen on your WordPress website. All you need is to setup and trigger some alerts.

User Activity Reports

Using the reporting module, you can create customized WordPress log reports, either in CSV or HTML format. The benefit is it does not restrict you to what type of data you can include in your WordPress reports.

You can also configure automated reports which you can receive via email on a daily, weekly, monthly or quarterly basis.

User Sessions Management

This tool allows you to see who is logged in to your WordPress website, remotely terminate sessions and block multiples sessions for the same user. You will automatically notified via email when multiple sessions of the same user are allowed or blocked.

Search

Manually browsing through thousands of alerts is a huge pain.
Thus, the ‘Search’ functionality allows you to search for a particular alert. It has both free-text based search and filters to make your job easier.

External Database

This database and integrations tool enables you to save the WordPress audit trail to an external database (rather than in the WordPress database). This keeps your main database small, manageable and fast.

Learn more about the WP Activity Log premium features and pricing

Final Thoughts

The WP Activity Log is a great plugin for all WordPress users as well as multisite users.

In terms of security, you can monitor what happens in your site’s backend area in real-time. At many occasions, these plugin acts as a wall to users who tries to breach security.

Not just that, using Temporary Login Without Password along with WP Activity Log is a great combo solution you would ever come across to keep a watch on all your WordPress users.

Give it a try and let us know about it in the comments section.