by Guido Schad 5 (4 reviews)

Who Changed It? – Activity Log & Audit Trail

Name: Who Changed It? – Activity Log & Audit Trail
Rating: 5.0 (4 reviews)
Author: Guido Schad

Activity log and audit trail: see who changed what, and when — logins, users, plugins, themes, posts, settings. Tamper-proof. Stays on your site.

Who Changed It? ranks #16,130 among WordPress.org plugins with 100+ active installations, is #827 of 5,058 in the Security category, a 5/5 rating from 4 reviews, and was last updated Aug 12, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 7.0.8 (Current: 7.1.4)

v0.9.0 Current Version v0.9.0

Updated 2 months ago Last Update on 12 Aug, 2026

Refreshed 1 week ago Last Refreshed on

#827 of 5,058 in Security Top 25% by installs

View on WordPress.org

Rank

#16,130

— No change

Active Installs

100+

+8.7%

KW Avg Position

21.5

0.3 better

Downloads

668

+2 today

Support Resolved

— No change

Rating

100%

Review 5 out of 5

5 (4 reviews)

Next Milestone 200

Total Progress 20%

100+ 200+

3,456

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 80 more installs to reach 200+

Rank Changes

Current #16,130

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

4 reviews

Overall 100%

4 (100%)

0 (0%)

Security History

Source: WPVulnerability

No known vulnerabilities on record for Who Changed It?. Checked 1 month ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 0.9.0
Last Updated: Aug 12, 2026
Requires WP: 6.0+
Tested Up To: 7.0.8
PHP Version: 7.4 or higher
Author: Guido Schad

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 4
Support Threads: 0
Resolved: 0%

Keywords

Activity Log audit log audit trail security user activity

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about Who Changed It? – Activity Log & Audit Trail

Open the Activity Log screen and search for the page title, or filter the event family to "content". Each edit shows the user, the time, the IP address, and a field-level diff of what actually changed — title, slug, excerpt, author, content length, password protection, parent.

Deletions are recorded like any other event, with the user who did it and the name of the thing that was deleted. Filter by the "content" family, or search the title of the missing item. A burst of deletions by one user is escalated to Dangerous automatically.

Filter the log by the "plugins" or "themes" family. Installs, updates, activations, deactivations and deletions are all recorded with the user who performed them. Use of the built-in theme and plugin file editor is classified Dangerous on sight, because that is how a compromised administrator account usually plants code.

Failed logins are recorded with the username tried and the originating IP. A burst of failures from one IP is escalated to Dangerous and triggers an email alert — throttled, so an attack sends you one message rather than hundreds.

It writes one row to its own database table when something happens, and nothing at all on ordinary page views by visitors. There are no external calls to wait on, and retention keeps the table from growing without limit. The reporting and diff work happens on the admin screen, not on the front end.

Three things. Every event is classified as Normal, Strange or Dangerous with a stated reason, so you are not scanning thousands of identical rows. The log is hash-chained, so an attacker who cleans up after themselves is detected instead of trusted. And exports are cryptographically signed, so what you hand an auditor or an insurer can be shown not to have been edited afterwards.

No. It records events as they happen, starting at activation.

3 months by default. Configure the retention window (or keep all data forever) on the settings screen; developers can additionally use the whochita_retention_days filter.

Yes. Events are grouped into families — authentication, users, content, plugins, themes, core, settings, WooCommerce, and a catch-all — and each family can keep the default window, use its own, or keep everything forever.

Yes — override the base severity of any event type with the whochita_base_severity_map filter, and extend the list of audited options with whochita_watched_options.