內容簡介
Activity Guard 是一款免費的 WordPress 外掛，提供完整的活動日誌、基於 IP 的安全防火牆、外掛漏洞掃描及 WooCommerce 放棄購物車分析，所有功能均可從單一控制台即時接收警報，無需付費。
【主要功能】
• 完整的活動日誌記錄
• 基於 IP 的安全防火牆
• 外掛漏洞掃描功能
• WooCommerce 放棄購物車分析
• 即時通知至 Slack 和 Telegram
外掛標籤
開發者團隊
② 後台搜尋「Activity Guard – Security Scanner, Activity Log with IP blocking」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
Activity Guard is a free WordPress plugin that covers four things most plugins charge separately for: a complete activity log, an IP-based security firewall, a plugin vulnerability scanner, and WooCommerce abandoned cart analytics. Alerts go out in real time to Slack, Telegram, or email, all from one dashboard.
Most activity log plugins stop at logging. Most security plugins don’t touch WooCommerce. Plugins like WP Activity Log, Simple History, and Stream do logging well — Activity Guard adds real-time Slack and Telegram alerts, an IP firewall with emergency shutdown, CVE vulnerability scanning, and WooCommerce abandoned cart recovery analytics, all at no cost. No paid tier required for any of it.
No other free plugin on WordPress.org combines these four in one place: a complete audit log, an IP security firewall, a multi-database vulnerability scanner, and WooCommerce analytics with cart recovery tracking.
Activity Guard Website | Documentation | Pro Support
WordPress Activity Log
Activity Guard records every meaningful change on your site, including the IP address, username, timestamp, and the exact change made. The audit log covers:
User logins, logouts, and failed login attempts
User registrations, role changes, and profile edits
Pages, posts, and custom post types: create, edit, delete, status changes
Plugin and theme activations, deactivations, updates, and deletions
WordPress core settings and configuration changes
Menu, widget, and sidebar modifications
Email delivery tracking via a full email log
Form submissions from Contact Form 7, SimpleForm, and others
Admin settings changes and debug log events
Cron job scheduling and background process tracking
Script modification and file change detection
Visitor traffic monitoring with an on/off toggle
Visual charts summarize your audit log at a glance. No need to scroll through raw log tables to understand what’s happening on your site.
Security Firewall and IP Blocking
Activity Guard actively blocks threats rather than just recording them.
IP blocking by manual entry, CIDR range, or conditional rule
Emergency Shutdown: force-logout every active session on your site with one click
Cloudflare Turnstile login protection against bots and brute force attacks
Login rate limiting to stop credential-stuffing
Bot detection and automatic IP blocking
Restrict or fully disable XML-RPC access
Core file integrity scanner to detect unauthorized file changes
File integrity monitoring across plugins and themes
Block TOR network access
Block vulnerability scanner user agents
HTTP security headers: custom, logged, and enforced
WordPress version hiding
404 error tracking and suspicious HTTP request alerts
Admin dashboard visitor tracking
Cron job failure and site downtime monitoring
The Emergency Shutdown feature is specific to Activity Guard: one click and every logged-in session on your site ends immediately — useful when you detect a breach in progress and need everyone out now.
Plugin Vulnerability Scanner
Activity Guard scans every installed plugin and theme against multiple vulnerability databases before problems develop:
Detect plugins with known CVEs across NVD, WPVulnerability.net, and the WPAzleen private API
Flag outdated plugins not compatible with your WordPress version
Identify abandoned plugins not updated in over a year
Warn about plugins with low install counts or poor ratings
No other free activity log plugin on WordPress.org includes a built-in multi-database vulnerability scanner.
WooCommerce Activity Log and Analytics
Activity Guard logs every WooCommerce event and adds analytics built specifically for store owners.
Order tracking covers status changes, payments, refunds, and cancellations. You also get stock level changes and low-stock events, coupon creation and usage, product pricing edits, billing and shipping address updates, customer registration changes, and real-time shipping status updates.
The abandoned cart and incomplete-order analytics go further than basic logging. The dashboard shows checkout drop-off rates, recovery potential, recovery rate, and how customers interact with their carts before leaving. This tells you where revenue is being lost, not just that it was lost.
WooCommerce abandoned cart analytics with recovery rate tracking is included free. No competing free activity log plugin on WordPress.org provides this.
Slack and Telegram Notifications
Activity Guard sends alerts the moment a critical event occurs, across four channels:
Slack: route alerts to any channel, tag specific users or groups with @mentions
Telegram: real-time activity and security alerts direct to your Telegram chat
Email: configurable per event type
Admin dashboard: in-panel notification view
Events that trigger alerts include core file changes, plugin and theme updates (with the username that triggered the update), WooCommerce orders, payments, coupon usage, incomplete order follow-ups, product edits, stock changes, login and registration events, page and post changes, form submissions, and admin settings changes. A daily digest and weekly plugin download summary are also available.
You can schedule notifications for specific times and control exactly which events send alerts.
Admin and Developer Tools
Maintenance mode toggle from the dashboard
Menu and widget change tracking
Plugin and theme activation and deactivation logs
Script modification detection
HTTP security header change logging
Debug log and fatal error detection
Email log: full delivery history for all outgoing WordPress emails
Contact Form 7 and SimpleForm integration alerts
Who Uses Activity Guard
WooCommerce store owners use it to track every order, coupon, product change, and shipping event, and to recover revenue with abandoned cart analytics. Site administrators use it to know exactly who changed what, instantly log out suspicious users, and maintain a clean audit trail. Agencies and developers use it to monitor plugin updates, configuration changes, fatal errors, and debug logs across client sites. Security-focused admins use it to block IPs, scan for CVEs, monitor file integrity, and trigger emergency shutdowns. Multi-author sites use it to hold contributors accountable with full user activity logging and role-change tracking.
Join us: Facebook | YouTube | X / Twitter
Complete Feature Breakdown
1. User Activity Log & Audit Trail
Authentication Tracking: Records successful logins, logouts, failed login attempts (with user agent, IP address, and timestamp), password resets, and account password changes.
User & Role Escalation Logging: Tracks new user registrations, profile updates, account deletions, and critical role changes (e.g., subscriber elevated to administrator).
Content & Publishing History: Tracks posts, pages, and custom post types (CPTs) across creation, draft saves, updates, trash, untrash, and permanent deletion.
Visual Content Diff Viewer: See exactly what text, code, or metadata changed between revisions with clean visual diff comparisons.
Plugin & Theme Lifecycle: Logs installations, activations, deactivations, updates (including the exact username who initiated the update), and deletions.
Theme File & Template Monitoring: Tracks modifications made to theme files, template assignments, and stylesheet updates.
Menu & Widget Monitoring: Records creation, restructuring, and deletion of navigation menus and sidebar widgets.
Site Settings & Options Audit: Logs modifications to core WordPress settings (wp_options), permalinks, reading settings, and site health notices.
Outgoing Email Delivery Log: Audits every email dispatched by wp_mail(), capturing recipients, subjects, timestamps, and delivery statuses.
Form Submission Tracking: Tracks submissions and captures leads from Contact Form 7 (CF7) and SimpleForm / FormFlow.
Categorized Tag Pills & Severity Badging: Quickly scan events labeled by Category (Security, Users, Content, System) and Severity (Critical, Warning, Info, Secure).
Search, Filter & Bulk Management: Filter logs by role, user, severity, event type, or date range (today, yesterday, this week, this month, or all-time). Delete individual or bulk entries in one click.
Export Audit Logs: Export your audit logs to CSV or JSON format for compliance audits, security reporting, or client delivery.
Custom Retention Schedule: Choose how long to retain logs (1, 7, 14, 30, 60, 90, 180, or 365 days) with automated database pruning to keep your database lean.
2. Security Suite & IP Blocking Firewall
Active User Session Manager: Monitor every logged-in user in real time, view IP addresses and browsers, and terminate active sessions instantly.
User Lockout Mechanism: Lock out compromised accounts for 10 minutes, 1 hour, 24 hours, or permanently until manual review.
Two-Factor Authentication (2FA TOTP): Secure login credentials with TOTP 2FA compatible with Google Authenticator, Authy, Microsoft Authenticator, and 1Password. Generates downloadable emergency backup codes.
Email-Based Login OTP (One-Time Password): Send a temporary verification code to the user’s email address upon login. Includes customizable email templates and expiry windows.
Country & Geo-IP Blocking: Restrict or whitelist access based on visitor country. Scope blocking to login/admin pages only or the entire front-end, with automatic bypass for search engine bots.
Custom Alert Rules Engine: Build custom alert rules based on events (e.g., administrator login), time windows (e.g., after-hours between 8 PM and 7 AM), frequency thresholds, and custom Slack mentions (@channel, @here).
Intelligent IP Blocker: Block malicious visitors by specific IP, CIDR subnet (e.g., 192.168.1.0/24), or automated behavioral triggers.
Brute Force Protection & Rate Limiting: Automatically block IPs after repeated failed login attempts or excessive requests per minute (>200 req/min).
404 Error Probing Defense: Detect and ban bot scrapers scanning for vulnerable URLs and non-existent scripts.
Suspicious Request Inspection: Detect SQL injection, malicious query strings, and exploit payloads in incoming HTTP requests.
Cloudflare Turnstile Bot Defense: Seamlessly integrate Cloudflare Turnstile on WordPress Login, Registration, Lost Password, Comment forms, and WooCommerce checkout.
Rename Login URL: Obfuscate /wp-login.php with a custom login slug (e.g., /secure-portal) and redirect unauthorized visitors to a 404 page or custom URL.
Prevent User Enumeration: Block author scan queries (such as /?author=1) that reveal administrative usernames.
Obfuscate Login Errors: Replace descriptive login errors with generic notices so attackers cannot deduce valid usernames.
Force Strong Passwords: Require all users (or specific roles) to configure high-entropy passwords.
TOR & Bad Bot Shield: Block exit nodes from the TOR network and ban automated vulnerability scanner user agents.
HTTP Security Headers Layer: Automatically enforce headers including X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy.
Conceal WordPress Version: Remove the WordPress version number from HTTP headers, generator meta tags, and script query strings.
Disable File Editing: Lock down the built-in WordPress theme and plugin code editors (DISALLOW_FILE_EDIT).
XML-RPC Protection: Disable or restrict the XML-RPC interface to stop pingback amplification and brute force attacks.
Domain Reputation & Blocklist Monitor: Periodically scan your site’s domain against major security blocklists to protect email deliverability and SEO rankings.
Emergency Shutdown (Kill Switch): With one click, instantly terminate all active sessions site-wide, locking down admin access exclusively to designated Super Admins.
3. Deep Vulnerability Scanner & Core Integrity Checker
Multi-Source Vulnerability Intelligence: Cross-checks installed plugins and themes against the National Vulnerability Database (NVD / NIST CVEs), WPVulnerability.net, and the WPAzleen private threat feed.
Abandoned & Outdated Plugin Audit: Identifies plugins that haven’t been updated in over a year, plugins incompatible with your WordPress version, or plugins with low ratings and install counts.
WordPress Core File Integrity Verification: Validates every core file against official WordPress.org release checksums. Flags modified, added, or missing files.
File Integrity Line Diff Viewer: View side-by-side differences within modified core, theme, or plugin files to spot injected malware or unauthorized edits.
WordPress Hardening Audit: Inspects file permissions (wp-config.php, .htaccess, /wp-content/), database prefix safety, security salts, and PHP error reporting.
Exclusions Manager: Exclude specific directories, file patterns, or PHP functions from scan routines.
Automated Scan Notifications: Send automated Slack alerts whenever vulnerabilities or checksum mismatches are discovered.
4. WooCommerce Activity Log & Abandoned Cart Analytics
Real-Time E-Commerce Event Alerts: Get notified the second an order is placed, marked paid, cancelled, or refunded.
Inventory & Stock Monitoring: Receive immediate warnings when products hit low-stock thresholds or run completely out of stock.
Coupon & Discount Tracking: Monitor coupon creation, modification, and customer redemptions in real time.
Product Catalog Changes: Track price modifications, title adjustments, inventory updates, and new product publications.
Customer Data Changes: Track customer profile updates, billing address changes, and shipping address modifications.
Abandoned Cart Tracker & Analytics: Log incomplete checkouts, track items left in carts, and monitor cart drop-offs before checkout completion.
Recovery Rate & Potential Revenue: Visual dashboard displaying recoverable revenue, checkout conversion drop-off rates, and cart recovery analytics.
Visual Sales Analytics: Interactive Recharts dashboard displaying gross sales, net revenue, average order value (AOV), total order count, and top-selling products.
5. Real-Time Slack Notifications & Integrations
Slack Incoming Webhooks: Route notifications to your Slack workspace with support for dedicated channels, custom webhook URLs, and user/group @mentions.
Slack Attachment Cards: Notifications feature color-coded severity bars, event titles, user avatars, IP addresses, timestamps, and direct administrative links.
Telegram Bot Integration: Deliver instant alerts to individual chats or team channels using your Telegram Bot Token and Chat ID.
Granular Event Subscriptions: Selectively choose which events send alerts to Slack, Telegram, or Email.
Custom Message Templates: Customize notification copy using dynamic placeholders like {username}, {ip_address}, {site_url}, {plugin_name}, and {event_type}.
Admin Floating Toast Stream: Experience real-time live activity toasts right inside the WordPress admin bar and dashboard, complete with sound alerts and adjustable intervals.
Admin Bar Security Badge: Keep a constant eye on site security status with a badge counter in the top WordPress admin toolbar.
Dashboard Security Widget: View overall security score, recent activity feeds, and blocked threats directly on your main WordPress dashboard.
6. Admin, Developer & Maintenance Tools
Maintenance Mode with Lead Capture: Put your site under maintenance with stylish templates while capturing prospective visitor leads with a built-in contact form.
PHP Debug Log Viewer: View wp-content/debug.log entries directly inside the admin panel with real-time fatal error notifications.
WP-Cron Job Monitor: Detect scheduled background processes, recurring task creation, and cron failures.
Site Downtime & Uptime Monitor: Monitor website responsiveness and receive alerts on HTTP error codes and downtime events.
Access Control & Permissions: Restrict Activity Guard configuration to specific Super Administrators or allowed roles.
Read-Only Log Viewers: Grant specific roles (e.g., Editors or Junior Admins) read-only access to audit logs without exposing configuration settings.
Stealth Mode (Hide Plugin): Hide Activity Guard from the WordPress plugins list to prevent tampering by unauthorized users.
Competitor Analysis
Search the WordPress plugin directory for an activity log plugin and a handful of names come up again and again, so it is worth being clear about where Activity Guard actually fits among them.
WP Activity Log is the biggest name in the category, with the broadest event coverage of any activity log plugin and support for tracking third-party plugins like ACF, Gravity Forms, and LearnDash. It is a genuine alternative to Activity Guard for pure logging depth, but Slack and SMS alerts sit behind WP Activity Log Premium, and there is no IP firewall, no vulnerability scanner, and no WooCommerce analytics at any tier. Activity Guard includes Slack and Telegram alerts, an IP firewall, vulnerability scanning, and WooCommerce abandoned cart analytics in the free version, with a narrower focus on the WordPress admin rather than enterprise SIEM exports.
Activity Log Pro is the closest match on structure. Its free tier also adds real security-adjacent …
