{"id":319317,"date":"2026-05-30T07:16:45","date_gmt":"2026-05-30T07:16:45","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/admin-activity-timeline\/"},"modified":"2026-05-30T07:16:25","modified_gmt":"2026-05-30T07:16:25","slug":"activitypilot","status":"publish","type":"plugin","link":"https:\/\/roh.wordpress.org\/plugins\/activitypilot\/","author":20578682,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.0","requires":"7.0","requires_php":"7.4","requires_plugins":null,"header_name":"ActivityPilot","header_author":"Piyush Asthana","header_description":"Track, visualize, and analyze all admin and user activities in a modern timeline interface. Helps developers and agencies debug issues, monitor changes, and maintain site integrity.","assets_banners_color":"","last_updated":"2026-05-30 07:16:25","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/profiles.wordpress.org\/piyushmultidots\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":32,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"piyushmultidots","date":"2026-05-30 07:16:25"}},"upgrade_notice":{"1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Dashboard with activity chart, top actions, and KPI tiles.","2":"Timeline with filters, search, severity badges, and pagination.","3":"Settings for tracking toggles, retention, break detection, and integrations.","4":"Analytics heatmap and hour-of-day charts.","5":"Workflow panel with status, assignee, and comments."}},"plugin_section":[],"plugin_tags":[8531,8534,5603,600,5575],"plugin_category":[54],"plugin_contributors":[214729],"plugin_business_model":[],"class_list":["post-319317","plugin","type-plugin","status-publish","hentry","plugin_tags-activity-log","plugin_tags-audit-log","plugin_tags-monitoring","plugin_tags-security","plugin_tags-timeline","plugin_category-security-and-spam-protection","plugin_contributors-piyushmultidots","plugin_committers-piyushmultidots"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/activitypilot.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>ActivityPilot is an activity log and audit-trail plugin for developers, agencies, and security-conscious site owners. Meaningful changes on your site \u2014 logins, content edits, plugin and theme operations, role changes, high-impact options, integrations, and more \u2014 are stored in a dedicated database table and shown in a modern admin timeline.<\/p>\n\n<h4>Privacy defaults<\/h4>\n\n<ul>\n<li>External-service features are <strong>opt-in<\/strong>.<\/li>\n<li>Geolocation (<code>ip-api.com<\/code>) is <strong>disabled by default<\/strong> (<code>enable_geo = 0<\/code>).<\/li>\n<li>Outbound webhooks (Slack\/Discord\/Teams\/custom URL) are <strong>disabled by default<\/strong> until you enable them and provide destination URLs.<\/li>\n<li>The plugin does not send data to third-party services unless you explicitly enable and configure those features.<\/li>\n<\/ul>\n\n<h4>Why use this plugin?<\/h4>\n\n<ul>\n<li><strong>Custom tables<\/strong> \u2014 logs live in <code>{prefix}apwpm_activity_logs<\/code> (not post meta) with indexes for fast queries.<\/li>\n<li><strong>Modern admin UI<\/strong> \u2014 dashboard, timeline, filters, search, pagination, exports, dark mode, and keyboard shortcuts.<\/li>\n<li><strong>Security-first<\/strong> \u2014 capability checks, REST nonces, prepared SQL, output escaping, and optional sudo mode for destructive actions.<\/li>\n<li><strong>Break detection<\/strong> \u2014 spots error spikes and surfaces recent risky changes.<\/li>\n<li><strong>Extensible<\/strong> \u2014 REST API (<code>activitypilot\/v1<\/code>), hooks, custom event registry, and PSR-3 adapter.<\/li>\n<\/ul>\n\n<h4>Core features<\/h4>\n\n<ul>\n<li>Activity logging for logins, posts, plugins, themes, users, roles, and important site options<\/li>\n<li>Timeline view with avatars, severity colors, and structured context<\/li>\n<li>Filters by user, action, object type, severity, date range, status, assignee, and search<\/li>\n<li>CSV and JSON exports; daily retention pruning via cron<\/li>\n<li>Email alerts when break detection finds unusual error activity<\/li>\n<li>Workflow: acknowledge, resolve, snooze, assign, and comment on events<\/li>\n<li>Smart insights: bursts, off-hours access, role escalation, and statistical spikes<\/li>\n<li>Optional rollback for supported change types (sudo-gated)<\/li>\n<li>Analytics heatmap, hour-of-day chart, and top users<\/li>\n<li>Scheduled HTML digest reports (daily, weekly, monthly)<\/li>\n<li>Multisite support with per-site tagging and network overview<\/li>\n<li>Hash-chain integrity verification (optional)<\/li>\n<li>File integrity monitoring, IP throttle, PII redaction, GDPR export\/erase helpers<\/li>\n<li>Integrations: WooCommerce, ACF, popular form builders, SEO plugins, page builders<\/li>\n<li>Optional outbound webhooks (Slack, Discord, Microsoft Teams, generic URL)<\/li>\n<li>WP-CLI: <code>wp apwpm list|count|verify|prune|purge|export|digest|scan-files<\/code><\/li>\n<\/ul>\n\n<h4>For developers<\/h4>\n\n<p>Log custom events from your code:<\/p>\n\n<pre><code>APWPM_Logger::log( array( 'action_type' =&gt; 'my_event', 'description' =&gt; 'Something happened' ) );\n<\/code><\/pre>\n\n<p>Filter hooks include <code>apwpm_skip_log<\/code>, <code>apwpm_pre_insert_row<\/code>, and <code>apwpm_register_event_types<\/code>. The shorter <code>ap_*<\/code> hook names from earlier builds are still fired for backward compatibility.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin can connect to third-party services <strong>only when you enable the related feature<\/strong> and, for webhooks, when you provide URLs.<\/p>\n\n<h4>IP geolocation (optional)<\/h4>\n\n<p>When <strong>Enable geolocation<\/strong> is on, the plugin may send the visitor IP address to <a href=\"http:\/\/ip-api.com\/\">ip-api.com<\/a> to resolve country and city. No API key is required. Results are cached in WordPress transients (about 24 hours). See the <a href=\"https:\/\/ip-api.com\/docs\/legal\">ip-api privacy policy<\/a> for their terms.<\/p>\n\n<ul>\n<li>Data sent: IP address (in the request URL).<\/li>\n<li>When: On log insert for events that include an IP, if geo is enabled and not already set.<\/li>\n<li>Purpose: Display country\/city on timeline rows and detect logins from new countries.<\/li>\n<\/ul>\n\n<h4>Outbound webhooks (optional)<\/h4>\n\n<p>When webhooks are enabled and URLs are saved in settings, the plugin sends HTTP POST requests to <strong>your<\/strong> endpoints (for example Slack, Discord, Microsoft Teams, or a custom URL) when qualifying events occur.<\/p>\n\n<ul>\n<li>Data sent: Event title, description, severity, site name, and related metadata you configure to receive.<\/li>\n<li>When: After an event is logged that meets your minimum severity threshold.<\/li>\n<li>Purpose: Notify external chat or monitoring systems.<\/li>\n<li>Services\/endpoints: Slack, Discord, Microsoft Teams, or any custom HTTPS endpoint that you explicitly configure.<\/li>\n<li>Terms\/privacy (when using those services):<br \/>\nSlack: https:\/\/slack.com\/terms-of-service , https:\/\/slack.com\/privacy-policy<br \/>\nDiscord: https:\/\/discord.com\/terms , https:\/\/discord.com\/privacy<br \/>\nMicrosoft Teams (Microsoft): https:\/\/www.microsoft.com\/servicesagreement , https:\/\/privacy.microsoft.com\/privacystatement<\/li>\n<\/ul>\n\n<p>Webhook delivery is fully optional and disabled by default. No webhook requests are sent until you enable webhooks and provide at least one destination URL.<\/p>\n\n<p>The plugin does not include bundled third-party API keys. Geolocation and webhooks are optional and disabled by default until configured by a site administrator.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>activitypilot<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> screen in WordPress.<\/li>\n<li>Open <strong>Activity Timeline<\/strong> in the admin menu.<\/li>\n<li>Review <strong>Settings<\/strong> to choose what to track, retention, alerts, and optional features.<\/li>\n<\/ol>\n\n<p>On multisite, network-activate for a shared log table under the network prefix.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20this%20slow%20down%20my%20site%3F\"><h3>Will this slow down my site?<\/h3><\/dt>\n<dd><p>Writes go to an indexed custom table. Heavy hooks are limited to admin and logged-in contexts where possible. Optional async batching groups writes at shutdown.<\/p><\/dd>\n<dt id=\"where%20are%20logs%20stored%3F\"><h3>Where are logs stored?<\/h3><\/dt>\n<dd><p>In <code>{prefix}apwpm_activity_logs<\/code>, with optional companion tables <code>{prefix}apwpm_comments<\/code> and <code>{prefix}apwpm_views<\/code>. Data is not stored in <code>wp_postmeta<\/code>.<\/p><\/dd>\n<dt id=\"can%20i%20export%20or%20delete%20logs%3F\"><h3>Can I export or delete logs?<\/h3><\/dt>\n<dd><p>Yes. Export from the admin UI or REST API. Prune by age via settings, cron, or <code>wp apwpm prune<\/code>. Full purge requires confirmation and sudo mode when enabled.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20multisite%3F\"><h3>Does it work on multisite?<\/h3><\/dt>\n<dd><p>Yes. Events are tagged with <code>blog_id<\/code>, and network admins get a network overview.<\/p><\/dd>\n<dt id=\"can%20i%20extend%20what%20gets%20logged%3F\"><h3>Can I extend what gets logged?<\/h3><\/dt>\n<dd><p>Yes. Call <code>APWPM_Logger::log()<\/code> or register types on <code>apwpm_register_event_types<\/code>. Use <code>apwpm_skip_log<\/code> to skip events and <code>apwpm_pre_insert_row<\/code> to adjust rows before insert.<\/p><\/dd>\n<dt id=\"is%20the%20log%20tamper-proof%3F\"><h3>Is the log tamper-proof?<\/h3><\/dt>\n<dd><p>When hash-chain mode is enabled, each row includes an HMAC chain. Run integrity checks from Site Health or <code>wp apwpm verify<\/code>. Append-only mode can block deletions for compliance use cases.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial WordPress.org release.<\/li>\n<li>Activity timeline with dashboard, filters, search, exports, and REST API (<code>activitypilot\/v1<\/code>).<\/li>\n<li>Break detection, smart insights, workflow (status, assignee, comments), and optional rollback.<\/li>\n<li>Analytics, reports, multisite support, hash-chain integrity, and Site Health checks.<\/li>\n<li>Integrations, optional webhooks, geolocation, GDPR tools, file integrity monitoring, and WP-CLI commands.<\/li>\n<li>Requires WordPress 7.0+ and PHP 7.4+.<\/li>\n<\/ul>","raw_excerpt":"Track, visualize, and analyze admin and user activity in a timeline UI with break detection, workflows, REST API, and exportable audit logs.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/319317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=319317"}],"author":[{"embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/piyushmultidots"}],"wp:attachment":[{"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=319317"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=319317"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=319317"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=319317"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=319317"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/roh.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=319317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}