Trailmark Activity Log

Description

Trailmark Activity Log records important administrative activity on your site and shows it in a clean, native-looking screen in your WordPress dashboard.

It answers one question: “Who did what, and when on my site?”

• Which user changed which post, and what exactly changed (title, content, status, categories, featured image…)?
• Who deleted a page or moved it to the Trash?
• Which plugin was installed, activated, deactivated, updated or deleted?
• Was a user created or deleted? Did someone’s role change from Editor to Administrator?
• Was the theme switched? Was WordPress updated?
• Who logged in, and are there failed login attempts?

Everything is free. There is no Pro version, no license key, no account and no data sent anywhere.

What is logged

• Posts, pages and custom post types: created, updated (with before/after values), published, unpublished, status changes, trashed, restored, permanently deleted.
• Media Library: uploads, edits (title, caption, description, alternative text) and deletions.
• Users: created, deleted, role changes, password changes (never the password itself) and email/display name/website changes.
• Plugins: installed, activated, deactivated, updated (old and new version), deleted.
• Themes: installed, switched, updated, deleted.
• WordPress core updates, manual or automatic.
• Important settings: site title, URLs, admin email, “Anyone can register”, new user default role, permalinks, search engine visibility and more.
• Logins, logouts and failed logins.
• The activity log itself: changes to its settings, exports, clearing the log, and deactivation of the plugin are always recorded, so nobody can quietly weaken your audit trail.

Features

• Native WordPress list screen with filters by user, action, object type and date (today, yesterday, last 7/30 days, custom range) plus search.
• Detail screen for every entry with a clear “Before / After” table of changes.
• “Recent Activity” dashboard widget.
• CSV export (Excel-friendly, protected against formula injection).
• Selective delete: remove only the entries matching the current filters.
• Automatic cleanup: keep logs for 30, 90, 180 days, 1 year, or forever, plus a maximum number of records (50,000 by default).
• Brute-force protection for the log: repeated failed logins are grouped into a single entry with a counter instead of flooding the database.
• Privacy options: full, anonymized or no IP addresses; optional user agent; unknown usernames of failed logins are not stored by default.
• Integrates with the WordPress personal data exporter and eraser.
• Interface in English and Turkish. The language follows WordPress automatically, or you can pick it in the settings. Existing entries are displayed in the chosen language too, because descriptions are generated when they are shown.
• Multisite compatible: each site has its own log.
• Developer friendly: trailmark_log() helper and filters such as trailmark_capability, trailmark_should_log, trailmark_excluded_post_types, trailmark_tracked_options and trailmark_trackers.

Performance

• One small INSERT per logged event, nothing else on the front end. Admin screens only load the rows of the current page.
• Changes made to the same object during one request are merged into a single entry, which also avoids duplicate entries from the block editor.
• The settings live in a single autoloaded option; no extra queries per request.
• Old entries are removed in small batches by WP-Cron, so large tables are never locked for long.

Privacy

This plugin stores activity data in your own WordPress database. It does not send data to any external service.

For each entry it stores: date and time (UTC), the acting user’s ID, username and role, the action, the affected object (type, ID, name) and, for updates, the changed values (for long content only a length, a fingerprint and a short excerpt). Depending on the settings it also stores the IP address (full, anonymized or not at all; anonymized by default) and the browser user agent.

Entries are deleted automatically after the retention period you choose (90 days by default), and the oldest entries are removed when the log exceeds 50,000 records (configurable).

The plugin registers a personal data exporter and eraser (Tools → Export/Erase Personal Data). The eraser anonymizes entries (removes the username, IP address, user agent and changed personal values) instead of deleting them, so the audit trail stays consistent. It also adds a suggested paragraph to the privacy policy guide (Settings → Privacy).

This plugin is a technical tool. Whether and how you may store this data depends on your jurisdiction and your use case; please check your own legal obligations.