See Who Changed What in WordPress: Logs for Staff

The price on your services page is wrong. Last week it was right. Three people in the office can edit the site, each of them says they did not touch it, and nobody is lying on purpose. They simply do not remember. You want a way to see who changed what in WordPress, so the next time it happens the answer takes a minute rather than an argument.

WordPress keeps a partial record by itself, and an activity log plugin fills in the rest. Which one you need depends on how many people work on the site and what kinds of changes worry you.

See who changed what in WordPress without a plugin

Out of the box, WordPress has no general activity log. It does not record logins, plugin installs, settings changes or who changed a user’s role. What it does keep is revisions for posts and pages.

Every time someone saves or updates a post or page, WordPress stores a copy of the content along with the name of the user who saved it and the time. To read them:

1. Open the page in the editor.
2. In the block editor, open the settings sidebar on the Page or Post tab and click Revisions, which appears with a count once there is more than one saved version. In the classic editor, the Revisions link sits in the Publish box.
3. Use the slider or the arrows to step through versions. Each one shows who saved it and when, with removed text in red and added text in green.

For the wrong price, this is usually all you need. Step back until the price changes and you will see the name next to it. Our guide to restoring an older version of a page with revisions covers comparing and rolling back in more detail.

Revisions have limits, though. They only cover content saved through the editor. Menus, widgets, plugin settings, user accounts and most theme options are not revisioned. Page builders such as Elementor keep their own history inside the builder, separate from WordPress revisions. And some hosts or developers reduce or switch off revisions to keep the database small, so check that yours are actually being kept.

An activity log for staff: what it adds

An activity log plugin writes down events across the whole site as they happen: who logged in and from which IP address, who published or deleted a page, who installed or deactivated a plugin, who changed a setting, who created a user or gave someone a new role. Each entry has a time, the account that did it and a short description.

Two well-known free options on wordpress.org are WP Activity Log and Simple History. Both record the common WordPress events and show them in a list inside the dashboard that you can filter by user, date or type of event. WP Activity Log goes into more detail and has paid add-ons for extra features; Simple History is lighter and easier to read at a glance. Look at the current plugin pages to see what each free version includes today, since features move between free and paid over time.

One important limit: a log only starts when the plugin is installed. It cannot tell you what happened last month if it was not running last month. That is the main reason to set one up on a quiet day rather than waiting until you need it.

Setting one up for a small team

1. Take a backup, as you would before adding any plugin.
2. Search for the log plugin you chose on the plugin installer screen, then install and activate it.
3. Open its settings and decide who can view the log. Keep it to administrators. The log shows other people’s activity and IP addresses, and Editors do not need that.
4. Set how long records are kept, if the plugin offers the choice. A few months covers most “who changed this?” questions without the log growing forever in your database.
5. Make a small test change, such as editing a draft, and check it appears in the log with your name.
6. Tell your team the log exists. That alone tends to make people more careful, and it avoids any feeling of being watched in secret.

What is worth watching on a business site

A busy log can bury the entries that matter under hundreds of routine ones. For a small business, these are the events worth checking when you look:

• Pages published, changed or trashed, especially your home page, service pages, prices and contact details.
• Users added, deleted or given a new role. A new Administrator you did not expect is always worth an immediate question.
• Plugins and themes installed, activated, deactivated or deleted. A form plugin switched off by accident can stop enquiries silently.
• Settings changes, such as the site address, the admin email, permalinks or the Reading options.
• Logins, including failed ones. A burst of failures on one account, or a login at an hour nobody works, deserves a second look.
• Shop changes on a WooCommerce site, if your plugin records them: product prices, stock, coupons and order status edits.

Some plugins can email you when a chosen event happens, such as a new administrator being created. If yours does, that one alert is worth switching on.

It only works if everyone has their own login

An activity log records accounts, not people. If three staff share one “office” login, the log will faithfully report that “office” changed the price, which is exactly what you knew already. Give each person their own account with the lowest role that fits their work; our post on giving each person only the role they need explains the choices. For the wider housekeeping of accounts, see the guide to managing WordPress users.

Also remember that an administrator can deactivate or delete the log plugin, and with it the records stored in the database. A log keeps honest people honest and settles everyday questions. It is not tamper-proof evidence against someone with full control of the site.

Privacy and your staff

An activity log stores personal data: usernames, email addresses, IP addresses and the times people worked. In the UK and EU, data protection law applies to that, and many other countries have similar rules. In practice that means:

• Have a clear reason, such as keeping the site secure and knowing who made a change.
• Tell staff and contractors that the site logs activity.
• Keep records only as long as you need them, and restrict who can view them.
• If customers log in to your site, mention it in your privacy policy, because their logins may be recorded too.

Use the log to answer questions about the website, not to measure how many hours someone spent in the dashboard. Staff who know it is there for the first reason rarely mind it.

When the question is a security one

Everything above assumes the changes came from your own people. If you find edits nobody on the team made, an administrator you do not recognise, or files and redirects you never created, the job is different. Our post on reading activity logs after a hack explains how to use the logs you have as evidence. This article belongs to our WordPress management guide, which covers the day-to-day running of a site rather than incident response.

Frequently asked questions

Can I find out who changed something before I installed a log plugin?

Only partly. For posts and pages, the Revisions screen shows who saved each version, as long as revisions were being kept. For settings, menus, plugins and users there is usually no record. Your host’s server logs may show which IP address made requests at that time, but they will not name the WordPress user.

Will an activity log plugin slow my site down?

For a typical small site with a handful of editors, the effect is usually small, because most events happen in the dashboard rather than on public pages. The log does grow in the database over time, so set a retention period if the plugin offers one, and avoid logging every visitor event unless you have a reason.

Can staff see their own activity or delete entries?

That depends on the plugin and its settings. Most let you choose which roles can view the log, and by default only administrators can manage it. Keep viewing to administrators and avoid giving staff an Administrator role, because anyone with that role can change the plugin’s settings or remove it.

An activity log sits naturally alongside routine care of a site. Our WordPress monthly maintenance plans cover safe updates, backups and keeping watch on security; whether a log should be part of that for your site is worth agreeing at the start.

Next in this series: WordPress Author Bio: Name, Photo and Profile Box