Every hacked site I clean ends the same way. The client asks one question, and it is never “is it gone.”
It is: “How did this happen?”
Usually followed by “and who did it.” Sometimes “was it someone on my team.” Occasionally “was it the last developer.”
And for most sites, the honest answer is that nobody knows, because nothing was recording.
WordPress does not keep a log by default. It does not tell you who logged in and when. It does not tell you who deactivated the security plugin, or who edited that file, or when that extra administrator account appeared. All of that just happens, silently, and the only evidence is the damage afterwards.
That is the gap I built WebProActivity to fill.
What it does
It writes down what happens on your site.
- Logins. Successful ones and failed ones, with the username, the IP and the time. Fifty failed attempts on your admin account at 3am is something you want to know about before it succeeds.
- User changes. New accounts, deleted accounts, role changes. A new administrator appearing is one of the most reliable signs of a compromise, and it is invisible unless somebody is watching for it.
- Plugin and theme activity. Installed, activated, deactivated, updated, deleted. If your firewall gets switched off, that is now a line in a log rather than a mystery.
- Content changes. Posts and pages created, edited and deleted, and by whom.
- Settings changes. Site URL, permalinks, admin email. Changing the admin email is a classic account takeover step.
Nothing clever. Just a record, kept properly, so that when something goes wrong there is something to read.
Why this matters more than it sounds
It turns a guess into an answer. “We think it was an old plugin” is not the same as “your contact form plugin was exploited on the 14th at 02:41 and an admin account was created four minutes later.” The second one tells you exactly what to fix.
It catches the slow problems. Most compromises are not dramatic. Someone gets in, creates an account, waits, and uses it weeks later. A log shows you the account creation on day one instead of the consequences on day thirty.
It settles the awkward questions. When something breaks and three people have access, a log ends the conversation quickly and without anyone having to accuse anyone.
It shows you what your plugins are doing. Auto updates that fired at the wrong time, a plugin that keeps reactivating itself, a scheduled task nobody remembers setting up.
Who this is for
Anyone running a WordPress site that matters to their business, particularly if:
- More than one person has admin access
- You have been hacked before, or cleaned an infection and are not certain it stayed clean
- You hand your site to developers or agencies from time to time
- You run a WooCommerce store, where a quiet change to payment settings is genuinely expensive
- Your site was built by somebody you are no longer in touch with
If you are the only person who ever touches a small brochure site, you probably do not need this. I would rather say that than pretend everyone does.
What it does not do
Being straight about the limits, because “security plugin” gets used far too loosely:
It is not a firewall. It does not block anything. It records. If you want blocking, use Wordfence alongside it.
It is not a malware scanner. It will not tell you that a file is infected. It will tell you that the file changed, which is often the earlier and more useful signal, but they are different jobs.
It will not undo anything. It is a record, not a backup. Keep taking backups.
A log is the thing that tells you what happened. Prevention and recovery are separate tools, and anyone selling you one plugin that claims to be all three is overselling.
Download it
It is free. No email required, no trial that expires, no upsell inside the dashboard.
Install it, activate it, and it starts recording. There is nothing to configure to get the basics working.
The honest reason I built it
I clean hacked WordPress sites. The hardest part of that work is not removing the malware, it is working out how the attacker got in, because if you do not close that door the site gets reinfected and the client reasonably concludes you did a bad job.
On sites with a log, I can answer that in twenty minutes. On sites without one, I am reconstructing events from file timestamps and guesswork, and sometimes the honest answer stays “probably this, but I cannot prove it.”
So now I install activity logging on every site I clean. It felt worth giving away.
If your site is currently infected, flagged by Google, or suspended by your host, that is a different problem and it needs fixing first. Here is how I handle malware removal, and what that work actually costs.
And if you just want someone keeping an eye on things so this conversation never has to happen, send me a message.
Common questions
Is WebProActivity really free?
Yes. No paid tier, no locked features, no email required to download.
Will it slow my site down?
It writes small database records when something happens. It does not run on every page load for ordinary visitors. On a normal site the impact is not measurable.
How long does it keep the log?
You set the retention period. Ninety days suits most sites. Longer if you are in a regulated industry, shorter if you are on tight hosting.
Can an attacker delete the log?
An attacker with full administrator access can do almost anything, including tampering with logs. That is true of every logging tool. What a log reliably catches is the period before they have full control, which is normally where the useful evidence is.
Do I still need a security plugin?
Yes. This records, it does not block. Run it alongside a firewall, not instead of one.
The bottom line
You cannot fix what you cannot see, and you cannot prove what nobody wrote down.
Install it before you need it. That is the whole point of a log.
