EHERO Audit Log – Audit log for WordPress and WooCommerce: who changed what, person or plugin

Audit log for WordPress and WooCommerce: who changed what, when and how, person or plugin

The audit log for WordPress from EHERO Audit Log is the black box of your website. When something happens that you didn’t expect — a price changes overnight, a product runs out of stock, a backup plugin someone disabled — it gives you the exact answer: who did it, what changed, when, from where, and what the previous value was.

Most logs stop at the logged-in user. But in a store with synchronizations, many changes are not made by a person: they are made by a plugin, a scheduled task, or an external program. This audit log for WordPress also tells you which plugin or theme made the change, with the file and line, and detects what was changed outside WordPress, where no other log looks.

And it does it without weighing things down: visits to your site add no queries, events are written once at the end of each request, and all the heavy work runs in the background. Each event is signed and chained to the previous one, so nobody can erase their tracks without verification flagging it.

Person or plugin: who really made each change

It’s the question every store with synchronizations asks: “Who changed the price at 3:00?”. The answer is almost never a person.

• Each event shows the logged-in user and, in addition, the plugin or theme that executed the change.
• With one click you see the exact file and line, and the WordPress action that triggered it.
• Scheduled tasks appear as “cron” and commands as “wp-cli”, with the originating request.
• Everything that happened in the same page load, grouped together: if an importer touched a hundred products, you see it together.

A complete audit log for WordPress with WooCommerce

Everything in WordPress and, with WooCommerce active, the entire store field by field. No separate extensions for products or orders.

• Products and variations: prices, stock, SKU, description, attributes, shipping, taxes, and visibility, with before and after.
• HPOS-compatible orders: creation, status changes, notes, refunds, line items, and addresses.
• Store: coupons, shipping and payment methods, taxes, and WooCommerce settings.
• Content, media, comments, menus, taxonomies, and custom fields.
• Users and access: signups, deletions, roles, logins, grouped failed attempts, and password resets (never the password).
• Plugins, themes, and core: installs, activations, updates, deletions, and file editing.

Before and after, history on every screen, and undo

It’s not enough to know that something changed: you need the previous value to fix it.

• Detailed view of each event with all fields before and after, and line-by-line comparison of long text.
• Change history inside the edit screen for each product, order, post, and page, and in each user’s profile.
• Undo post, product, custom field, and user data changes with one click.
• If the object changed again afterward, it warns you before overwriting anything.

Changes made outside WordPress

Some changes never go through WordPress: an edit in phpMyAdmin, an ERP writing directly to the tables, or a file uploaded by FTP. No hook fires, and a normal log won’t see them.

• Compares background fingerprints of administrators, key settings (site URL, admin email, default role, active plugins), and all product fields.
• Checks the PHP files of WordPress, plugins, and themes every 6 hours.
• Separates expected changes from unexpected ones: a change that matches a recorded update is not an alert.
• Looks for PHP files in the uploads folder, where they should never be.
• Everything it detects enters the log as another event, with its alert.

Instant alerts, without flooding you

You find out about the important stuff when it happens, not a week later while checking the log.

• Email, Slack, Discord, Telegram, or webhook with signed JSON, each channel with its own test button.
• Rules by area, event type, and minimum importance: critical, security, plugins, prices, or whatever you define.
• Daily summary at the time you choose with everything else.
• Alert limit per rule and hour, so an importer doesn’t fill your inbox.
• They are sent in the background, so they never slow down a page.

A tamper-proof log

An intruder first tries to erase their tracks. Here they can’t do it without it being noticed.

• Each event is signed and chained to the previous one in its area.
• Verification, weekly or on demand, detects edits, deletions, and insertions and says exactly where.
• The signing key can live in wp-config.php: even with full database access, events cannot be forged.
• The guardian keeps logging even if someone disables the plugin from the dashboard, and leaves a critical entry if they remove it.
• Individual events cannot be edited or deleted; emptying the log requires confirmation and is recorded.

Site health: what breaks is logged too

Many store problems are not changes made by anyone, but things that fail silently.

• Fatal PHP errors, with the responsible plugin and file.
• Emails that could not be sent, such as the notice for a new order.
• HTTP requests to external services that fail or are slow.
• Scheduled tasks that fail or are delayed, and slow requests from your own site.

Summary and viewer to find everything in seconds

See what’s happening in your store at a glance, and the exact event when you need it.

• Activity by day and area, alerts, critical events, and failed logins from the last 24 hours.
• Who changes the most things, which plugins touch your store, and which events are most frequent.
• Filters by date, person, role, area, importance, event type, plugin, object, source, IP, and text.
• Quick views, saved filters, and CSV or JSON export, even for large logs.

Compliance report ready for audits

When a client, insurer, or auditor asks for it, you have it in one click. Designed with GDPR Article 32, the NIS2 directive, ISO 27001, and DORA in mind.

• Activity by area, access, privilege changes, and alerts for the period you choose.
• Log integrity status, with the latest full verification.
• Print or save as PDF directly from the browser.
• Read-only Auditor role for your consultant, DPO, or auditor, without access to the rest of the dashboard.

External backup and central console for multiple sites

If someone takes full control of the server, they can delete the log. An off-site copy cannot.

• Signed delivery of events to your own webhook: your SIEM, storage, or automation.
• Central console: one of your sites receives the full history of the others and alerts you if any stops reporting.
• If the destination is down, delivery pauses and continues where it left off, without losing anything.
• Age-based cleanup never deletes what has not yet reached the external copy.

A WordPress audit log that doesn’t slow down your site

Logging everything can’t come at the cost of speed. That’s why the design starts with performance.

• Visits to the site add no database queries.
• Events are kept in memory during the request and written all at once at the end.
• Signing, detection, alerts, external backup, and cleanup run in the background, in small batches and with a time limit.
• Repeated events are grouped with a counter, tables are custom and indexed, and retention is capped.

Privacy, WP-CLI and custom events

Made in the EU and designed so that the log itself complies with what it helps prove.

• IP anonymized by default, export and deletion of personal data from WordPress tools, and text for your privacy policy.
• It never stores passwords or keys: settings that look like secrets are logged hidden.
• Retention by days, general and by area, and a row limit.
• WP-CLI commands to list, export, verify, seal and scan, and an action so your own plugins can log their events.

Ideal for

If more than one person or more than one plugin touches your site, the audit log for WordPress from EHERO Audit Log saves you hours of looking for culprits. Where it pays off most:

📋 System requirements

Compatibility tested with the current versions of WordPress and WooCommerce.

🛟 Technical support

Email support in Spanish* at soporte@consultoriaehero.com and a complete manual inside the plugin. The audit log for WordPress updates itself from your dashboard during the license year.

⚖️ Comparison: why EHERO Audit Log?

What sets this audit log for WordPress apart from free activity logs and generic premium ones.

The next time something changes without permission, you’ll know who did it, person or plugin, and undo it in one click. Start today from 99.99 €.

Put a black box on your site with the EHERO Audit Log audit log for WordPress.

Want to see more tools for your store? Discover all our plugins for WooCommerce or visit the Consultoría EHERO store.

*Support covers incidents, errors, and plugin installation; it does not include consulting, custom configurations, or custom development. Conditions apply.