Activity Track – User Activity Log & Security Monitor

Activity Track – User Activity Log & Security Monitor records what happens on your WordPress site and tells you when something needs your attention. See who changed what, spot suspicious sign-ins and scanning attempts, and follow WooCommerce payment problems, all in a clean, modern dashboard.

Most activity logs only list events. Activity Track also connects related events into Incidents, so you see one clear story (“5 failed sign-ins, then a successful sign-in, then a new administrator”) with the reason it was flagged and what to check next. Activity Track Pro adds AI explanations with no API key needed.

What you get for free

• User activity log: logins, logouts and failed logins; post and page edits; plugin and theme changes; user and role changes; media; settings; menus, widgets and comments.
• Security incidents: warnings for a successful sign-in after repeated failed attempts, new administrator access, and sensitive changes made soon after a flagged sign-in.
• 404 monitoring and scan detection: see every missing page, and get an incident when a visitor probes for sensitive files such as .env and backups, or scans for vulnerable scripts.
• WooCommerce activity: orders, status changes and refunds, plus checkout and Stripe payment outcomes with decline reasons.
• Email alerts: notification rules for selected activities and users, and alerts for high priority incidents.
• Search, filters and CSV export for audits and troubleshooting.
• Privacy-first: incident evidence never stores raw IP addresses, passwords or typed usernames, and personal-data export and erasure are supported.
• Multisite compatible.

Who it’s for

• Site owners who want to know when something unusual happens.
• Agencies managing client sites and needing a clear record of changes.
• WooCommerce stores that need to understand failed payments and customer account activity.
• Content and security teams that need accountability.

Why Activity Track

• Explains, not just lists: incidents group related activity and suggest what to check.
• A useful free version: incidents, 404 scan detection and WooCommerce payment insights are included in Free.
• Monitoring only: it never blocks visitors or changes your site, so it works alongside your firewall or security plugin.
• Simple, modern interface that fits the WordPress admin.

Activity Track Pro adds AI explanations, extra incident checks, longer history and priority support.

WooCommerce Activity (Free)

Connect recorded account activity, checkout submissions, saved payment methods, and payment outcomes in one timeline. Includes customer/order summaries, grouped profile updates, outcome badges, and links to related timelines.

• Enable WooCommerce under Activity Track → Settings → Enable Activity Types to show the WooCommerce Activity menu. Enable User to record registration, sign-ins, and profile changes.
• Supported Stripe events are collected through the WooCommerce Stripe gateway. Live webhook recording is shown separately from WooCommerce payment completion; an unconfirmed webhook does not mean a payment failed.
• Review notices highlight five or more recorded live Stripe payment/card-setup failures for the same linked user within ten minutes. Failures can be legitimate retries and do not prove fraud.
• Profile changes store allowlisted categories, not field values. Older events may not contain changed-field details.
• Summaries cover the events on the current page. Tracking starts when enabled; missing records do not prove no activity occurred.
• Monitoring only: this feature does not block customers, validate cards, or replace WooCommerce order management or payment-provider fraud controls. No raw card details or payment payloads are stored by this recorder.

Free works independently. Pro is optional and requires the Free plugin to remain installed and active.

Incidents (Free)

Review security warnings in Activity Track → Incidents, the second tab beside Activity Log. Turn on monitoring in Monitoring settings; it is off by default.

• Flag a successful sign-in after at least five failed attempts targeting the same existing account within fifteen minutes, with the successful sign-in inside the thirty-minute detection window.
• Flag new administrator accounts and administrator role grants. A flagged sign-in becomes high priority if the same account grants administrator access, activates a plugin, or changes a monitored registration, role, site URL or administrator email setting within one hour.
• Check your own site once a day for sensitive files that must never be public (.env, Git data, wp-config backups, debug.log, database dumps, site archives). Only files that exist on disk are requested, content is verified, and each exposed file opens a high priority incident. Check now re-runs this check.
• Flag signed-in accounts that probe for hidden files (high priority). Anonymous bot scans that only receive 404 responses found nothing, so they are counted in a daily summary on the 404 Errors page instead of opening incidents. These checks require 404 Errors tracking to be enabled.
• Filter by status, priority and date; search incidents; and open a detail dialog with the evidence timeline, reason for the warning and suggested checks.
• Resolve incidents as Addressed, Expected activity or False alarm, with an optional note. Configure email alerts for high priority findings and administrator grants, with review-only alerts optional.
• Select individual open incidents or all open incidents on the current page and apply one resolution together. Already-resolved incidents retain their existing resolution; current filters are preserved.
• Checks run locally in bounded background batches, scheduled about every five minutes through WordPress Cron. Use Check now for a manual run. Scheduling depends on site traffic or a configured cron runner.
• Account checks use account IDs. 404 checks use a daily salted visitor fingerprint; incident evidence does not store raw IP addresses, passwords or attempted usernames. The separate source logs retain their own privacy settings. WordPress personal-data export and erasure are supported.
• Resolved incidents are kept for thirty days in Free. Incident evidence is retained separately from the source logs.
• Monitoring starts when enabled. Warnings indicate activity to review, not proof of compromise; this feature does not block requests or change accounts, plugins or site settings.

An activated Pro license adds a high priority incident when a visitor that scanned the site (including plugin and theme discovery scans) also tries to sign in, optional AI explanations and ninety-day retention for resolved incidents.

404 Errors (Free)

Review final front-end 404 responses in Activity Track → 404 Errors, with requested URLs, referrers, device information, and recorded visitor details.

• Tracking is enabled by default. Turn it off under Activity Track → Settings → Enable 404 tracking.
• Search recorded URLs, filter by date, export CSV, and delete selected records.
• The Source column explains recorded same-site, search-engine and external referrers. Without a referrer, it describes sensitive-file probes, script probes, detected bots, or direct/unknown requests. Recorded headers are clues, not verified attribution.
• Open a related incident directly from a linked 404 row. CSV exports include Source beside the retained Referrer URL.
• URL query values are redacted. Capture does not perform remote location lookups and respects the IP logging setting.
• Recording is limited to 60 per minute and 5,000 per day. At 10,000 stored records, the oldest 1,000 are deleted in a batch before adding more. Age-based retention still applies (30 days by default).
• Pause or resume recording directly on the 404 page. Existing records remain accessible while paused; automatic retention cleanup continues. Recording status shows active, paused, or capture-limit states. Skipped responses are not backfilled.
• Bot labels use User-Agent automation signals. Unrecognized clients probing PHP files in common scanner targets are labeled Suspected bot. Labels apply to existing records and CSV exports; they do not verify identity or block requests.
• Monitoring only: this feature does not redirect URLs or block requests. Earlier 404 responses are not backfilled.

External Services

For IP location labels in the main activity log, the plugin may send an IP address to one of the following HTTPS services when displaying the log and a cached location is unavailable. Requests also include the site’s WordPress version in the User-Agent header. Event recording uses cached locations only and does not perform remote location lookups. The 404 recorder does not make these requests either.

• IP2Location.io: https://api.ip2location.io/ — Terms and Privacy.
• IPinfo: https://ipinfo.io/ — Terms and Privacy.

Free works without the optional Pro service. Pro features are provided by a separate plugin; review its service disclosures before enabling them.

IP recording uses the connecting address (REMOTE_ADDR) by default. Forwarded IP headers are accepted only from proxy addresses explicitly configured through the atkai_trusted_proxies filter. Sites behind a proxy or CDN must configure trusted proxy addresses to retain forwarded visitor IPs in the main activity log.

Pro Features (Optional Upgrade)

• 🛡 Incident Investigation: Add plugin/theme discovery checks, scan-to-sign-in correlation, optional AI explanations of incident evidence, and ninety-day resolved-incident retention with an activated Pro license.

• 🤖 AI-Driven Summaries
  Request a structured explanation of a recorded log, with a summary, impact, suggested next steps, and limits of the available evidence.

• 🌐 VPN & Proxy Detection
  Automatically flag or exclude traffic coming from known VPNs, proxies or TOR nodes.

• 🔒 IP Anonymization & Hashing
  Meet GDPR/CCPA requirements by masking or hashing visitor IP addresses.

• 🗂️ Grouped Activity Logs
  Consolidate repeated events into single entries with frequency counts for cleaner analysis.

• ⏱ Advanced Time Filters
  See data for the last 24 hours, 7 days, 30 days or any custom interval.

• 🚨 Unlimited Notification Rules
  Create as many email notifications as you need—no caps.

• 🛠 Priority Email Support
  Get fast, expert help whenever you need it.

Source Code & Human-Readable Files

We include both the original (human-readable) and the minified assets in this ZIP so you can review or fork them directly.

— JavaScript sources (in assets/admin/js/):
• flowbite.js
– original Flowbite source (upstream: https://github.com/themesberg/flowbite)
• flowbite.min.js
– minified Flowbite
• atk.notifications.js
– our plugin’s notifications logic (un-minified)
• atk.settings.js
– our plugin’s settings page logic (un-minified)

— CSS sources (in assets/admin/css/):
• tailwind-admin.css
– compiled Tailwind CSS for admin pages (un-minified)
• atk.custom.css
– plugin custom overrides (un-minified)
• atk.notifications.css
– notification panel styles (un-minified)
• atk.settings.css
– settings page styles (un-minified)

— Production assets enqueued by the plugin:
• all .min.js files from assets/admin/js/
• all .css files from assets/admin/css/

License

This plugin is released under the GPLv2 (or later). Free to use, modify, and redistribute.