---
title: Event logging
canonical: https://wpsecurityninja.com/dictionary/event-logging/
---
# Event logging

Event logging records security-relevant actions so you can see what changed and when.

## Why it matters for WordPress

When something goes wrong, memory is a bad forensic tool. A timeline of logins, plugin installs, option changes, and new users answers “who did that?” without guessing from a backup dump.

## How it shows up in practice

- An unknown Administrator appears and nobody remembers creating it
- A plugin activates overnight on a site nobody was editing
- Failed login storms, then one success from a new country
- Post-cleanup reviews where you need to prove what changed and when

## What to do

1. Enable an events log before you need it, not after the breach call.
2. Keep log data away from low-privilege roles that should not rewrite history.
3. Glance at the log after deploys, staff changes, and security alerts.
4. Retain enough history to cover “we noticed this a week late.”

## In WP Security Ninja

The [Events Logger](https://wpsecurityninja.com/events-logger/) records logins, blocks, and site activity so you can rebuild a timeline after a scare. It pairs well with login protection and malware cleanup: the log shows the odd admin create or plugin install that the scanner alone will not explain.