內容簡介
Dragon Activity Log 是一款功能強大的 WordPress 外掛，專門用於記錄網站上的所有活動，提供快速且可搜尋的審核日誌，幫助用戶追蹤變更並增強安全性。
【主要功能】
• 實時活動流：即時顯示網站活動更新
• 一鍵回滾：輕鬆恢復先前的設置或角色
• 安全警報：透過電子郵件通知異常登錄行為
• CSV 和 JSON 匯出：方便下載符合篩選的事件
• 完整前後差異：顯示變更前後的詳細內容
• 隱私控制：選擇性記錄或匿名化 IP 地址
外掛標籤
開發者團隊
② 後台搜尋「Dragon Activity Log – Audit Log, User Activity Tracking & Security Audit Trail」→ 直接安裝（推薦）
原文外掛簡介
Dragon Activity Log records what happens on your WordPress site in a fast, searchable audit trail that lives in its own database table. Unlike a plain event list, it shows the field-level change for the fields listed below (the old role and the new role, the old setting value and the new one, a renamed title or slug), and it links every event to the one before it with a SHA-256 hash so that a later edit or deletion of the log can be detected.
Everything in this plugin is free and fully functional: every event type, no cap on the number of events stored, any retention window including “keep forever”, all filters and search, live updates, integrity verification, one-click rollback of settings and role changes, full before/after diffs, security alert emails, CSV and JSON export, WooCommerce events, and the WP-CLI commands. (Individual values in the change detail of a log row are shortened at 500 characters; the full diff keeps the whole value.)
Why Dragon Activity Log
Field-level change detail – before and after values for post title, slug and excerpt, user email, display name, URL and roles, media title, caption and alt text, and single-value settings (array settings show their item count, and a post body is flagged as changed in the row)
Full before/after diffs – “Full details” on a post or setting event opens a side-by-side diff of the whole post content, title, excerpt and status, or of the whole setting value, kept from the moment of the change
One-click rollback – put a changed setting back to its previous value, or undo a role change, from the same dialog. A rollback only runs while the setting or the user’s roles still hold exactly what the event left behind, follows WordPress’s own rules for who may change roles, and is itself recorded in the chained log
Security alerts by email – a login from an IP address the user has not used before, a burst of failed logins from one address, and a user made administrator (or super admin on a network), sent to the site admin email or a list of addresses you choose. Off until you switch them on
CSV and JSON export – download the events that match the filters on screen; spreadsheet formulas in exported cells are neutralised, and every export is itself logged
WooCommerce events – new orders, order status changes, stock quantity and stock status changes, and new coupons, recorded while WooCommerce is active
Tamper-evident hash chain – every event is chained to the previous one; one click checks the chain (up to 25 seconds in the browser; the WP-CLI command checks a log of any size end to end) and reports the first event whose link no longer matches
Off-site anchor – email (and optionally post to a signed webhook) the chain head daily or weekly, then compare the log against any anchor later: proof that the log was not rewritten, even by someone with database access
Site Health – an integrity test and an anchor test on the Site Health screen, plus a debug-information section
Fast and lean – events live in their own indexed table, never in your posts table, and are pruned automatically on the retention window you choose
Live activity stream – new activity appears on the log screen as it happens
Privacy controls – capture, anonymize or skip IP addresses, and exclude trusted roles from logging
Privacy tools integration – events caused by a user, events about their account, failed logins against their username or email, and events about comments they wrote (guests included) are covered by WordPress personal data export and erasure requests
WP-CLI – wp dragon-activity-log list, prune, anchor and verify
What gets logged
Logins – successful logins, logouts, failed logins, password resets
Users – registration, profile changes, role changes, deletion, and on multisite removal from a site and super admin grants and revocations
Content – posts, pages and custom post types: create, edit, status change, trash, restore, delete
Plugins and themes – activate, deactivate, install, update (and a failed single update), delete, switch
Settings – WordPress and plugin option changes and deletions, with secret-shaped values redacted (option writes made by background cron tasks are skipped unless they touch core settings)
Media – uploads, title, caption and alt text edits, deletions
Taxonomies – term create, edit and delete for categories, tags, menus and custom taxonomies
Comments – submitted, approved, unapproved, spam, trashed, deleted
Core – WordPress core updates and content exports
WooCommerce (while it is active) – new orders, order status changes, product stock quantity and stock status changes, new coupons. Orders are no longer also logged as posts on stores that keep orders in the posts table, and a new coupon is logged once as a coupon (its later edits as post events). Store events recorded with no logged-in user (a guest checkout, a payment gateway callback or a scheduled task) keep no IP address
The log itself – clearing, retention cleanup, anchors, exports, rollbacks and failed alert deliveries
WP-CLI
wp dragon-activity-log list [--limit=]
wp dragon-activity-log prune
wp dragon-activity-log anchor – send an off-site anchor now
wp dragon-activity-log verify [--anchor=
External services
This plugin does not connect to any external service of ours or of any third party. All logging, hashing and verification runs on your own server.
The optional off-site anchor sends the chain head (an event number, a hash, your site URL and a timestamp; never any event data) to a destination you configure: by email through your site’s normal mail delivery, and, only if you enter a webhook URL, by an HTTPS POST to that URL. Nothing is sent unless you turn the anchor on.
The optional security alerts send an email through your site’s normal mail delivery to the site admin email or the addresses you list. An alert names the site, the user concerned, the acting user or the attempted username, and the IP addresses involved (a burst alert can list several), and links to the activity log. Nothing is sent unless you turn the alerts on.
Credits
The WordPress.org listing icon is drawn with glyphs from Lucide (https://lucide.dev), ISC License. Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part of Feather (https://feathericons.com, MIT License). All other copyright (c) for Lucide are held by Lucide Contributors 2022. The plugin itself does not include these icons.
Privacy Policy
Dragon Activity Log stores activity data locally in your WordPress database, including usernames, IP addresses (unless disabled or anonymized), and details of changes made on your site. It does not send any data to third parties. IP capture can be disabled or anonymized in the settings. WooCommerce events recorded with no logged-in user (a guest checkout, a payment gateway callback or a scheduled task) are stored without an IP address, because they cannot be matched to a person’s email address. WordPress personal data export and erasure requests are matched by email address and cover events caused by the user, events about their account, failed logins against their username or email, and events about comments written with that email (so guest commenters are covered too). Events about comments that have since been deleted can no longer be matched to an email address.
