Dragon Activity Log

A tamper-evident audit log: every entry is cryptographically chained to the one before it, so silent edits to history are detectable — not just "mirrored somewhere else".

Requirements

WordPress 6.2+, PHP 8.0+.

What gets logged

Content changes (with field-level detail of what changed), user logins/logouts and profile changes, plugin/theme/core updates, settings changes, and more. Dragon plugins (Login Security, Redirect Manager…) feed their own events in automatically when active.

The hash chain

Each event is sealed into a chain where every entry carries a hash of its predecessor. Tools → Activity Log Integrity verifies the whole chain and pinpoints the first broken link if anything was altered or deleted directly in the database. Sealing runs asynchronously so logging adds no meaningful overhead to requests.

Reading the log

Tools → Activity Log shows the stream with filtering by user, event type and date. Field-level change detail shows exactly what changed, not just "post updated".

Data & privacy

Events live in your own database and are pruned on your retention schedule. IP capture is optional and can be anonymised. The plugin registers WordPress privacy-tools integration for personal data. Uninstalling keeps your log by default — an audit trail you can lose by clicking uninstall isn't much of an audit trail; opt into deletion in Settings.

Dragon Activity Log Pro

Adds rich before/after diffs, one-click rollback of content changes, security alerts, session tracking with forced logout, scheduled reports, and WooCommerce event coverage.

Uninstall

Deleting the plugin keeps all its data by default, so a reinstall picks up where you left off. To remove everything on uninstall, tick Delete all data on uninstall in the plugin's settings first (this sets the dragonactivitylog_delete_data_on_uninstall option).