“Who Changed That?” — Why Every WordPress Site Needs an Audit Log

The question every incident starts with

Something looks off — a setting that’s different from how you left it, a plugin that’s suddenly disabled, an admin account you don’t remember creating. The first question is always the same: what actually happened, and when? Without some record of changes on your site, answering that question honestly is often “I don’t know,” which is exactly the wrong position to be in while trying to figure out whether you’re dealing with a real problem or an innocent explanation.

What an audit log is actually for

An audit log is a running record of the changes that matter on your site — not everything that ever happens (that would be an unreadable flood of noise), but the specific events worth being able to look back on: who logged in and when, who tried to log in and failed, when a plugin was activated or deactivated, when a theme changed, when a user’s role or permissions were modified, when key settings were updated. The value isn’t in watching it constantly. It’s in having it there, intact and readable, the one time you actually need to ask “what changed here?”

Why this matters even on a site with one admin (you)

It’s tempting to think an audit log only matters for sites with multiple people involved — a team, an agency managing it, several admin accounts. It matters just as much on a single-admin site, for a different reason: it’s often the only way to tell the difference between “I made that change myself and forgot” and “something or someone else made that change.” Memory is unreliable, and a log is the only honest source of truth when you’re trying to rule out the more concerning explanation.

What makes a log worth actually trusting

• It has to actually run, continuously, without you remembering to turn it on. A log you have to manually enable before checking something is a log that was off during the exact moment you needed it.
• It needs to stay manageable, not grow forever unchecked. A log nobody’s pruned in two years, with no summary and no easy way to search it, is technically a record — but it’s not one anyone’s actually going to use when it matters, because by then it’s too large to make sense of quickly.
• It should tell you at a glance whether anything’s worth a closer look, rather than requiring you to read every entry to notice the one that matters.

Where this lands in the free plugin

Loyal Security’s audit log tracks the changes that matter on your site, with a clear storage summary and a simple way to clear it out when you want to — free, no separate add-on required. If you’ve ever asked “wait, who changed that?” and had no good answer, the WordPress.org listing covers what it tracks.