by
Dragon Core
1 (0 reviews)
Dragon Activity Log - Audit Log, User Activity Tracking & Security Audit Trail
A tamper-evident activity log for WordPress. See who changed what, when, and from where, with field-level before/after detail.
Dragon Activity Log ranks #60,982 among WordPress.org plugins with 1+ active installations, is #2,643 of 4,589 in the Security category, a 1/5 rating from 0 reviews, and was last updated Sep 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v1.0.15
Current Version v1.0.15
Updated 1 week ago
Last Update on 13 Sep, 2026
Refreshed 6 hours ago
Last Refreshed on
#2,643 of 4,589 in Security
Downloads -78.2% this week
Actively maintained
Rank
#60,982
—
No change
Active Installs
1+
-2%
KW Avg Position
105
9.5 better
Downloads
170
+1 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 10
0+
10+
60,036
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 8 more installs to reach 10+
Rank Changes
Current
#60,982
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.15
- Last Updated
- Sep 13, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.1
- PHP Version
- 8.0 or higher
- Author
- Dragon Core
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,758
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,008
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Dragon Activity Log - Audit Log, User Activity Tracking & Security Audit Trail
Logging is a single indexed database write per action. The tamper-evidence hashing runs separately: an hourly WP-Cron job, plus a short end-of-request pass on roughly one request in twenty (capped at 200 events and two seconds) after the page has been generated.
Each event stores a SHA-256 hash computed over its own contents plus the previous event's hash, forming a chain. Editing or deleting any event breaks the chain from that point on, and the integrity check reports the first broken link. This is tamper evidence: it detects edits and deletions made outside the plugin, it does not prevent someone with database access from making them. Use it alongside normal access control and backups.
Two things, by design. First, events are hashed into the chain by a background pass (hourly, plus a short end-of-request pass), so a row deleted before it is sealed leaves no trace; on a quiet site without WP-Cron traffic that window can be up to an hour. Second, someone with write access to your database who also recomputes every later hash and the stored chain head can hide an edit from the self-check. That is what the off-site anchor is for: compare the log against an anchor you received earlier and such a rewrite is caught. Clearing the log or erasing someone's data rebuilds the chain; the event that records it says whether the chain was intact beforehand.
On the Settings tab, choose daily or weekly. On that schedule the plugin seals the chain and emails the chain head (an event number and a hash, never any event data) to the address you choose; ideally one outside this site. You can also have it posted to an https webhook you control, signed with a per-site secret. Keep those messages. At any time, paste an anchor reference into Integrity > "Compare with an anchor" (or run wp dragon-activity-log verify --anchor=<reference>): the plugin recomputes the chain up to that event and confirms it still produces the anchored hash. "Send anchor now" takes one immediately.
No. Events are stored in a dedicated wp_dal_events table in your own database. Nothing is sent to Dragon Core or any third party.
By default the connecting address (REMOTE_ADDR). Proxy headers such as X-Forwarded-For are ignored unless you enable "Trust proxy headers", because visitors can forge them. You can also anonymize IP addresses or turn capture off entirely.
Yes. Set the retention to 0 days on the Settings tab.
Editor autosaves, background (cron) option writes other than core settings, the plugin's own bookkeeping options, first/last name, nickname and biography changes (email, display name, URL, password and roles are covered), network-wide (multisite) settings, and the success of each package in a bulk plugin or theme update (the update run is recorded per requested package). When "Trust proxy headers" is on, the address appended by the single proxy in front of the site is used; chains of several proxies are not walked.
Option and field names that look like secrets are recorded as "[redacted]" and their values are never read by the plugin: anything containing password, pass, pwd, secret, token, auth, nonce, salt, private, api, license, licence or credential, or containing _key. Password changes are recorded as "(changed)", never the hash. Post bodies are never stored, only the fact that the content changed.
