The Activity Log tracks events across seven different areas of your WordPress site. Each area has its own event category, which you can enable, disable, or filter on independently. Here’s a full breakdown of what gets recorded in each category.

User Events

The User category covers authentication and user account changes. These are some of the most important events to monitor for security.

Events tracked include:

– User Logged In (Info) — Successful login
– Login Failed (High) — Failed login attempt, including the username tried
– User Logged Out (Info)
– User Created (Medium) — New user account added
– User Updated (Low) — Profile details changed
– User Deleted (High)
– User Role Changed (High) — Logs both old and new role
– Password Changed (Medium)
– Email Changed (Medium)
– Password Reset Requested (Medium)

Content Events

The Content category tracks all changes to posts, pages, media files, custom fields, and featured images.

Post and page events: Created, Updated, Published, Deleted (to trash or permanently), Status Changed (e.g. draft to pending review).

Media events: Media Uploaded, Media Updated, Media Deleted.

Custom field (post meta) events: Custom Field Added, Custom Field Updated, Custom Field Deleted — these log the field name and the value change.

Featured image events: Featured Image Set, Featured Image Changed, Featured Image Removed.

Revisions, autosaves, and nav menu items are excluded from content tracking by design.

Plugin and Theme Events

The Plugin and Theme categories track all lifecycle changes to your installed plugins and themes.

Plugin events: Plugin Installed, Plugin Activated (Medium), Plugin Deactivated (Medium), Plugin Updated (Medium), Plugin Deleted (High).

Theme events: Theme Installed (Medium), Theme Activated (Medium) — logs both the old and new active theme, Theme Deleted (High).

WordPress Core and Settings

The WordPress category tracks core updates and changes to important WordPress options.

WordPress Updated (High) — Logs the version number whenever core updates.

Settings Changed (Medium) and Option Changed (Low) — Track changes to WordPress options like site URL, admin email, permalink structure, timezone, comment settings, and more. Sensitive values (passwords, secret keys) are automatically redacted and logged as [REDACTED].

WordPress Export (Medium) — Logged whenever someone exports site content from Tools › Export.

Comment Events

The Content category also includes comment tracking:

– Comment Created — New comment submitted (spam comments are excluded)
– Comment Approved — Comment moved from pending to approved
– Comment Updated — Comment content edited
– Comment Deleted
– Comment Marked Spam

Each event logs the comment author and the post it belongs to.

Menus, Widgets, and Navigation

The Appearance category tracks changes to your site’s navigation menus and widget areas.

Menu events: Menu Created, Menu Updated, Menu Deleted (Medium), Menu Item Added, Menu Item Updated, Menu Item Deleted.

Widget events: Widget Added, Widget Updated, Widget Removed.

Categories and Tags

The Taxonomy category tracks changes to categories, tags, and custom taxonomy terms.

– Taxonomy Term Created (Low) – Taxonomy Term Updated (Low) – Taxonomy Term Deleted (Medium) – Terms Assigned to Post (Low) – Terms Removed from Post (Low)

Navigation menu terms, link categories, post formats, and other internal WordPress taxonomies are excluded from tracking by design.

To enable or disable any of these categories, go to Activity Log › Settings › Events.