Features Provided
How to See Who Changed Something on Your WordPress Site
When something on your WordPress site changes unexpectedly, the Logify activity log tells you exactly who did it and when. Every meaningful action — logins, failed login attempts, post edits, plugin and theme changes, role changes, and deletions — is recorded with a timestamp, the user responsible, and the IP address it came from. Open Logify → Activity Logs to trace any change back to its source.
What is the activity log?
The Logify activity log is a chronological record of meaningful actions on your WordPress site. Instead of guessing what happened before a problem appeared, you get a searchable audit trail that answers four questions for every event: who performed the action, what they did, when it happened, and where the request came from.
It is useful for site owners who want accountability, teams with several content editors, agencies managing client sites, and developers troubleshooting an unexpected change.
How to open the activity log
Go to Logify → Activity Logs in your WordPress admin sidebar. You will see a list of recorded events, grouped by day with Today, Yesterday, and date separators so the most recent activity is at the top.
What each log entry shows
Each row in the table records one event across these columns:
| Column | What it tells you |
|---|---|
| Time | When the action happened. Rows are grouped by day and the column is sortable. |
| Severity | A colour-coded badge from Emergency down to Debug, so critical events stand out. Sortable. |
| IP Address | The source IP, with the resolved country where available. |
| User | The account that performed the action. |
| Event | The type of event, such as a login or a post update. |
| Object | The specific item affected — the post, plugin, user, or setting involved. |
| Action | What was done to the object (created, updated, deleted, and so on). |
| Description | A plain-language summary of the event. |
| Details | An eye icon that opens the full record, including a before-and-after view for changes such as profile, setting, and term edits. |
Common examples you will see
Typical entries in the log include:
- A user logged in successfully, or a login attempt failed.
- A page or post was updated, published, or deleted.
- A plugin was activated, updated, or deleted.
- A theme was switched or updated.
- A user role was changed, or a new user registered.
Failed logins are worth watching. Logify records each failed attempt as a security event, and when one IP and user hit five failures within five minutes, it groups them into a single brute-force event so a password-guessing attack is obvious at a glance.
How to find a specific change fast
Above the table, a filter bar narrows the log to exactly what you are investigating:
- Event Type — limit to users, posts, plugins, security, and other categories.
- User — show only actions by one account.
- Severity — filter by minimum severity (100+ through 700+).
- Date From / Date To — restrict to the window around when the problem appeared.
- Search — free-text match against the description, object name, IP, or username.
Use Reset to clear the filters. For a deeper walk-through of filtering, see How Can I Find Important Website Changes Quickly?.
What to do when you find a suspicious change
- Open the entry with the eye icon and note the user, time, and IP address.
- Check the before-and-after details to see exactly what changed.
- Filter the log to the same user or time window to see what else happened around that moment.
- Decide whether to act — for example, reset a password, revoke access, or roll back the change.
Conclusion
The Logify activity log turns "something changed and no one knows why" into a clear, timestamped answer. With severity badges, per-column detail, and a full filter bar, you can move from noticing a problem to identifying its cause in a few clicks. Next, learn to filter the log quickly or get the big-picture view on the Logify dashboard.
FAQs
How do I see who deleted a post or page in WordPress?
Go to Logify → Activity Logs and filter the Event Type to posts, or search for the item's title. The matching row shows the User who deleted it, the Time, the IP Address, and an Action of deleted. Open the entry with the eye icon to see the full details of the removed content.
Can I see failed login attempts in Logify?
Yes. Logify records every failed login as a security event with the attempted username and source IP. When a single IP and user reach five failed attempts within five minutes, Logify aggregates them into one brute-force event, making a password-guessing attack easy to spot. Filter the Event Type to security to review them.
What does the severity badge on each log entry mean?
Severity is a colour-coded rank of how important an event is, from Emergency (highest) down through Critical, High, Alert, Warning, Notice, Info, and Debug. It lets you focus on serious events — such as failed logins or file edits — without reading every row. The Severity column is sortable, and you can filter the log by a minimum severity level.
Can I see what a user changed, not just that they changed something?
Yes. Click the eye icon in the Details column of any entry to open the full record. For changes such as profile updates, setting changes, taxonomy terms, and widget layouts, Logify shows a before-and-after comparison so you can see exactly which values were altered, not just that an edit occurred.
Does Logify record the IP address and location of each action?
Yes. Every entry stores the source IP address, and Logify resolves it to a country in the background where possible, shown alongside the IP in the IP Address column. This helps you tell routine activity from logins in unexpected locations. See How Logify Determines IP Address and Country for details.