Dragon Activity Log

Dragon Activity Log 1.1.0 adds one-click rollback of settings and role changes, full before/after diffs, security alert emails, CSV and JSON export, and WooCommerce events, all free.

New

• Roll back a change. Open "Full details" on a setting change or a role change and put it back with one click. A rollback only runs while the setting or the user's roles still hold exactly what the event left behind, follows WordPress's rules for who may change roles (you cannot remove your own), and is recorded in the tamper-evident log as "Change rolled back", even when your role is excluded from logging. A change that created or deleted a setting is not rolled back, and the dialog says why. Restoring a permalink setting has WordPress rebuild its permalink rules on the next page load; when it leaves plain permalinks, the dialog asks you to save Settings > Permalinks once. Post edits and trashed posts stay with WordPress's own revisions and Trash.
• Full before/after diffs. Post and setting events now keep a copy of the state before and after the change, so "Full details" shows the whole post content or the whole setting value side by side. Settings whose name looks like a secret are never copied, nested secrets are hidden, and each copy is deleted with its event. On a network, the full value of a setting is shown only to super admins.
• Security alerts by email. Get an email when someone logs in from an IP address they have not used before, when one address racks up a burst of failed logins, or when a user is made administrator (or super admin on a network). Off until you switch them on under Settings > Security alerts; alerts go to the site admin email or up to 10 addresses you choose. At most one burst alert is sent per window for the whole site, listing the other addresses that reached the limit since the previous one, and IPv6 addresses are counted per /64 network, so an attack from many addresses cannot flood your inbox.
• Export the log. CSV and JSON buttons on the log tab download the events that match your current filters. Spreadsheet formulas in CSV cells are neutralised, and every export is itself logged.
• WooCommerce events. While WooCommerce is active, new orders, order status changes, stock quantity and stock status changes, and new coupons are recorded. Store events recorded with no logged-in user (guest checkouts, payment gateway callbacks, scheduled tasks) are stored without an IP address. Compatible with High-Performance Order Storage.

Good to know

• Rollback and full diffs work for changes made after you update to 1.1.0.
• These features used to be a separate Pro add-on. If you still have it active, deactivate it: until you do, the built-in versions stay off so nothing is recorded or emailed twice. Nothing is carried over from the add-on: switch the security alerts on again under Settings after deactivating it, and diffs and rollback cover changes recorded from then on (the add-on's earlier diffs are not carried over).
• The "Upgrade to Pro" link and notes are gone.

Closes a way to hide an edited event from the integrity check and the off-site anchor, and makes retention cleanup check the chain before it deletes anything.

Integrity and anchors

• Someone with database access could hide an edited event from both the integrity check and an off-site anchor by changing one setting. The chain now treats any event below its starting point as a break, and an anchor whose events were removed is only explained by a matching event recorded in the sealed log itself.
• An anchor that can no longer be checked (its events were removed by retention cleanup, Clear log or a privacy erasure) says why and names the event that explains it, with its date. It is never shown as a match. wp dragon-activity-log verify --anchor exits with 0 for a match, 2 when the anchor cannot be checked, and 1 otherwise.
• A log whose newest events were cut off now reads as broken instead of "beyond the current chain".
• A database read error during a check is reported as a read error, not as tampering or a timeout.

Retention cleanup

• Cleanup verifies the events it is about to remove, never removes events that are not sealed yet, and records every cleanup that removes events in the log. If the chain is broken, cleanup pauses and the Settings tab and Site Health say so; Clear log rebuilds the chain.
• One event with a far-future date no longer stops cleanup, and a very large retention value no longer breaks it.

Anchor delivery

• The webhook signing secret is stored encrypted. Redirects are not followed, and the Integrity tab and Site Health show whether the last anchor was delivered.

What gets logged

• New: failed single plugin and theme updates, removal from a network site, and super admin grants and revocations.
• Less noise: saving settings without a change, a theme switch's own bookkeeping, and Dragon Pro licence re-checks no longer add rows.
• Credentials inside serialized settings are no longer stored, nested secret keys are redacted before a change reaches an add-on, and the anchor webhook address is recorded as its host only.

Settings, privacy and uninstall

• An invalid retention value, anchor email or trusted proxy entry is rejected with a message and the previous value is kept.
• The personal-data export no longer includes another person's IP address or username for events about the requester.
• Uninstall deletes data only when the opt-in is clearly on (1, true, yes or on).

Security checks

• Each admin action checks its own security token and your permission, and every submitted value goes through WordPress's own sanitizers.
• A plugin update is logged under the plugin's new name even when the plugin list was read earlier in the same request.
• Saving settings with a malformed webhook field no longer writes a PHP warning to the debug log.

Fixed: changes to secret settings are logged again, with the values hidden.

What's new in 1.0.20

• Fixed: since 1.0.11, a change to a setting that holds a secret (an API key, token, licence key or password) was not logged at all. It is now logged as "Changed (value hidden)", and the secret itself is never stored.
• Setting a secret and then setting it back in the same request is not logged, as there was no net change.

Anchor checks are harder to fool, and settings from the very first release carry over.

What's new in 1.0.19

• Anchor checks only accept a clear or privacy erasure recorded inside the sealed log itself, so a gap cannot be hidden by editing a setting. Rewrites still show as a mismatch.
• An anchor due while the log is being resealed is retried 15 minutes later instead of being skipped.
• Anchors made before a Clear log or an erasure report the events as rebuilt or erased, not rewritten.
• Sites upgrading straight from 1.0.0 keep their retention and exclusion settings.

Reliability fixes for the audit log and anchor checks.

What's new in 1.0.18

• Anchor checks now say when older events were removed by retention cleanup or a privacy erasure, instead of reporting a broken chain.
• Clear, rebuild and erasure events show readable details.
• Settings that other Dragon plugins use for their own bookkeeping are no longer logged as setting changes.
• Log times follow your site's date format.

Translation-ready throughout, with clearer log details.

What's new in 1.0.17

• Every screen, email and alert is now translatable, so community translations from translate.wordpress.org cover the whole plugin. Counts use proper plural forms, and numbers and dates follow your site's language.
• Clear, rebuild and privacy-erasure events show readable details in the log and the live stream.
• The personal-data export lists changes as readable lines instead of raw data.
• Log times follow your site's date format.

Quieter debug logs: scheduled tasks now wait until WordPress has finished loading.

• Fixed: when one of Dragon Activity Log's scheduled tasks needed re-creating, it was scheduled before WordPress had finished loading. WordPress then logged "translation loading was triggered too early" notices that named other plugins, which could send you looking in the wrong place. Scheduling now waits until WordPress is ready.

The notices only appeared with debug logging switched on. Nothing else changes: no settings, no stored data, nothing to do after updating.

A quiet pointer to the Pro add-on: an Upgrade to Pro link on the Plugins screen, a one-line note at the foot of the plugin's screens, and a single dismissible notice once the plugin has done its job. Nothing in the free plugin is locked or changed, and all three disappear when Pro is active.

Listing only: a clearer WordPress.org title and tags, so people searching for an audit log or user activity trail can find the plugin. No functional changes.

Adds a one-time WordPress.org review prompt on the Activity Log screen after your first integrity check or anchor. No other changes.

• Now hosted on WordPress.org: https://wordpress.org/plugins/dragon-activity-log/

Off-site chain anchor (email the chain head on a schedule, optionally to a signed webhook, and compare the log against any anchor later) and Site Health integration.

= 1.0.12 =

• New: off-site chain anchor. Email the chain head daily or weekly (optionally also to a signed webhook you control), send one on demand, and compare the log against any anchor from the Integrity tab or WP-CLI (verify --anchor=<reference>). Each anchor is recorded in the log itself. This closes the one gap a self-checking chain has: a rewrite by someone with database access.
• New: Site Health integration. An "Activity log integrity" test, an "off-site anchor" test, and a Dragon Activity Log section under Info.

Secret-shaped settings (API keys, tokens, passwords, licences) are never read by the log when they change or are deleted; the change is still recorded with the value dropped at the source.

= 1.0.11 =

• Secret-shaped settings (API keys, tokens, passwords, licences) are no longer read at all when they change or are deleted: the event still records that the setting changed, but the value is dropped at the source and is not passed to add-ons either.

Integrity chain hardening (the hash now covers the event id with an unambiguous encoding; chains rebuild once on update), honest verification results, safer cleanup and erasure, trusted proxy list, working Screen Options, and a quieter log.

= 1.0.10 =

• Integrity chain hardening: the hash now covers the event id and uses an unambiguous encoding, so a row cannot be renumbered or have field boundaries shifted unnoticed. Existing chains are rebuilt once after updating (the log itself is untouched).
• Verification now says exactly what it checked: it reports events not yet sealed, tells you when it ran out of time on a very large log, and no longer reports "intact" when another process held the lock.
• Clearing the log or erasing someone's data checks the chain first and records the outcome; an erasure that removes nothing leaves the chain alone.
• Retention cleanup removes a contiguous block of oldest events and re-anchors after every batch, so an interrupted run can never leave the chain unverifiable; "Run cleanup now" applies the number in the retention field, saved or not, and says so.
• Optional list of trusted proxy addresses (IPs or CIDR ranges): when set, proxy headers are honoured only for connections from those addresses.
• Screen Options on the log now work: choose how many events to show per page and hide columns; live-stream rows respect hidden columns, keep the page at its size and update the item count.
• Hosts whose database cannot provide advisory locks (for example Galera clusters) fall back to an owned option-row lease, so sealing and cleanup keep running there.
• The background sealer reads the chain state straight from the database before every write, so no cache layer can hand it a stale copy.
• The events table is created on first load for any site that never ran activation, and a missing table (restored database, manual drop) is recreated on the next request instead of surfacing database errors.
• Live-stream rows now show the object type and the field-level change table, exactly like rows rendered on load; a log cleared from another tab reloads open log screens; a lost session shows a message instead of silently stopping; typing a page number in the pagination box works.
• Publishing a draft while editing it records one event carrying both the status change and the field changes (previously the field changes were lost). Role additions and removals, and network user deletions, are recorded.
• Less noise: editor autosaves of a draft, and the two option writes behind a theme switch, no longer add rows (the theme switch itself is still logged). On a network, option changes made while switched to another site are recorded on that site.
• JSON-encoded settings values are summarised like arrays instead of being stored verbatim, so a credential nested inside one never reaches the log.
• Comment status events use translated labels; setting an image's alt text for the first time logs once, and removing it is recorded.
• Retention runs during normal traffic when WP-Cron never fires; network deactivation clears scheduled tasks on every site.
• Accessibility: the active tab is announced, change-detail field names are proper row headers, settings guidance meets contrast requirements, and layout mirrors correctly for right-to-left languages.

One tabbed Tools > Activity Log screen, logins attributed to the right user, privacy export and erasure cover everything about a user, and the Dragon design-system pills throughout.

= 1.0.9 =

• The log, integrity check and settings now live on one Tools > Activity Log screen with tabs instead of three separate Tools menu entries. Old links redirect.
• Logins, logouts and password resets are attributed to the user concerned instead of "System / Guest" (WordPress fires those hooks before it sets the current user), so role exclusions apply to them and privacy export and erasure cover them.
• Personal data export and erasure now include events about the user's account and failed logins against their username, not only events they caused.
• Live updates pause automatically while a filter, search or a page other than the first is active, so filtered views are no longer interrupted by unfiltered rows.
• Severity is shown with the Dragon design system's tinted pills and row markers, and the integrity and cleanup messages are now translatable.
• New "Run cleanup now" button on the Settings tab applies the retention window immediately.
• Media alt text changes are recorded with the old and new value; previously that field never showed a difference.
• Changes to the plugin's own settings are logged, and clearing the log records a "log cleared" event as the first row of the new chain.
• Date filters use the site's timezone; the retention field only accepts whole days; the daily cleanup and chain reset coordinate with the background sealer so a rare overlap cannot leave the chain unverifiable.
• The events table is created on sites that never ran activation (network activation only runs it on the main site) and schema updates apply on upgrade.
• Events are no longer recorded before WordPress has finished loading, which fixes a "translation loading triggered too early" notice when another plugin crashed during startup.
• Uninstalling with "Delete all data" opted in now also removes that setting itself, and on a network it runs for every site.
• Network activation creates the events table on every site, and new network sites get one automatically.
• Fresh plugin and theme installs are recorded (previously only updates were); deleted options are recorded too.
• The live stream delivers bursts larger than one page across consecutive polls instead of skipping the middle, and guest rows show the "System / Guest" label.
• The migration of settings from the 1.0.0 option names has been removed; sites still on 1.0.0 start with default settings after updating.

The retention setting now accepts 0 to keep events forever - any retention window, or none at all, is available in the free plugin.

= 1.0.8 =

• Retention: the retention setting now accepts 0 to keep events forever. Any retention window, or none at all, is available in the free plugin.

Security & integrity update: tamper checks now detect if the most recent log entries are deleted, and stored secrets are authenticated at rest.

= 1.0.7 =

• Security: integrity verification now detects truncation of the newest sealed log entries (deleting the tail no longer passes as "verified").
• Hardening: secrets stored at rest now use authenticated encryption; existing data keeps working.

Tested and verified on WordPress 7.1.

• Compatibility: tested up to WordPress 7.1.

Accessibility improvements across the log screens: screen-reader labels on every filter and proper table header markup.

Your data now survives uninstall by default.

Uninstalling no longer deletes the plugin's data unless you explicitly opt in first, so removing it to debug — or coming back later — keeps everything intact. Where the plugin has a settings screen you'll find a new "Delete all data on uninstall" option; leave it off to keep your data.

A cleaner, consistent look: the Dragon design system arrives.

This release brings Dragon Core's design system to every screen: a consistent header with the Dragon mark, cleaner tables, and unified status colours across the whole plugin family. Purely visual — everything behaves exactly as before.