=== BlogCutter Activity Log & Security Audit === Contributors: blgctterai Tags: activity log, security, audit, monitoring, login Requires at least: 6.0 Tested up to: 7.1 Stable tag: 6.0.0 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Activity log and security audit for WordPress. Track logins, content changes, and admin actions from a clear dashboard. == Description == BlogCutter Activity Log & Security Audit records important actions on your WordPress site and shows them in a searchable admin dashboard. Logs stay on your site. They are not sent to BlogCutter or any other remote service. The plugin is tested with WordPress 7.1. It does not add scripts to the block editor canvas, so the iframed post editor in 7.1 does not affect logging. = What it records = * Successful logins, logouts, and failed sign-in attempts * Password reset requests and completions * User account, profile, and role changes * Application password create and revoke events * Posts, pages, media, comments, menus, widgets, and taxonomy terms * Plugin, theme, and WordPress core updates * Important core setting changes (not every options-table write) * 404 errors and public search queries * Optional guest visits (off by default, one log per IP and URL each hour) * Optional outgoing email and REST write requests = Dashboard = * Filter by time range and event type * Search by user, IP, or message * Color-coded event types * CSV and JSON export of the current filters * Active sessions list with the option to end another user's sessions * Failed-login summary by IP * Daily cleanup by age and maximum row count * WordPress privacy exporter and eraser support * Optional email when one IP fails login too many times in an hour On WordPress 6.9 and 7.1 the plugin also registers read-only Abilities for an audit summary and recent log rows. Those abilities are not exposed on the REST API. = Privacy = All log data is stored in a database table on your WordPress site. Administrators can export or delete it. Suggested privacy-policy text is added under Settings → Privacy. Guest visit logging is optional and off by default. == Installation == 1. Upload the plugin folder to `/wp-content/plugins/`. 2. Activate **BlogCutter Activity Log & Security Audit**. 3. Open **Activity Log** in the admin menu. 4. Review **Activity Log → Settings**. == Frequently Asked Questions == = Does this work with WordPress 7.1? = Yes. Version 6.0.0 is tested up to WordPress 7.1. Logging runs in PHP on standard WordPress hooks and does not depend on the block editor iframe. = Does it slow the site down? = Logging is limited to events you enable. Guest page-visit logging is off by default. When it is on, the same IP and URL are recorded at most once per hour. Known bots can be ignored. = Where are logs stored? = In the `wp_bcal_logs` database table (with your site prefix). Older file-based logs from version 5 are imported once after you update. = Can I export logs? = Yes. Export CSV or JSON from the dashboard. Exports follow the filters you have selected. = Can I stop logging guest visits? = Yes. Guest visits are off by default. 404 and search logging can be turned off separately. = Does this block brute-force attacks? = No. It records failed logins and can email the site admin after repeated failures from one IP. It does not block IPs or replace a firewall. = Is the data sent off-site? = No. Logs stay in your WordPress database. == Screenshots == 1. Dashboard with stats, time filters, type chips, and the activity table 2. Active sessions with last activity and end-session action 3. Security overview with failed logins grouped by IP 4. Settings grouped by storage, security, content, and traffic 5. Help page with storage and WordPress 7.1 notes == Changelog == = 6.0.0 = * Tested with WordPress 7.1 * Store events in a database table instead of a growing log file * Import existing 5.x vault file entries on upgrade * Add time-range and event-type filters * Add JSON export and filter-aware CSV export * Add logout, password reset, media, user, and application-password tracking * Add optional failed-login email alerts * Add session sign-out for other users * Add daily retention by days and maximum rows * Add WordPress privacy exporter, eraser, and policy text * Register read-only Abilities on WordPress 6.9+ * Rebuild the admin UI to match WordPress admin patterns * Turn guest visit logging off by default and debounce it * Log only important core settings instead of every option update * Require WordPress 6.0 or newer = 5.1.0 = * Search, pagination, and dashboard styling updates = 5.0.1 = * Search bar and pagination improvements = 5.0.0 = * Session list, 404 monitoring, comments, roles, and security view = 4.5.0 = * Filesystem and escaping improvements == Upgrade Notice == = 6.0.0 = Major update for WordPress 7.1. Logs move to a database table. WordPress 6.0+ is required. Review settings after updating.