How to Log User Activity in WordPress with Simple History

This article is a localized edition of the Japanese original. Read the Japanese original

On a site where several people use the admin area, a record of who did what and when (an activity log) helps you track down the cause of a mistake or notice a login you don't recognize. WordPress core has no such logging, so you add it with a plugin.

This article shows how to set up logging with Simple History, a free plugin with an easy-to-read interface. Plugin details are as of November 2026.

How the main plugins differ

There are several activity log plugins, but these two are widely used in the official WordPress.org directory.

Setting up WP Activity Log is covered in How to set up a security audit log in WordPress. To log activity yourself with hooks instead of a plugin, see How to log user activity in WordPress.

What Simple History logs

The free version of Simple History logs actions like these (excerpted from the official description):

• Logins, logouts and failed logins
• Creating, editing and deleting posts, pages and custom post types
• Media uploads and edits, and changes to categories, tags, comments, menus and widgets
• User profile changes and role changes
• Installing, updating, activating, deactivating and deleting plugins and themes
• WordPress core and translation updates, and changes made on settings screens

Only actions after the plugin is activated are logged. Nothing that happened before activation can be recorded retroactively.

Step 1: Install the plugin

In the admin area, go to "Plugins" → "Add New Plugin", search for "Simple History," then install and activate it. If you have WP-CLI, this command does the same thing:

wp plugin install simple-history --activate

As of November 2026, Simple History (the 5.36 line) requires WordPress 6.3 or later and PHP 7.4 or later.

Step 2: View the log

Once activated, Simple History adds its own item to the admin sidebar (near the top of the menu by default). Open it to see a list of actions, newest first. It also adds a Dashboard widget so you can check recent activity at a glance.

You can filter the list by date range, user, type of action and keyword. For example, to show only failed logins, filter by action type or keyword. Click an IP address to show all actions from that same address.

You can move the menu in Simple History's settings: to the top or bottom of the main menu, or inside "Dashboard" or "Tools."

Step 3: Decide how long to keep logs

Simple History deletes old log entries automatically. The default retention period is 30 days (60 days for sites that have used it since before version 5.25.0). Changing retention from the admin screen is a premium feature, but the free version lets you change the number of days with a filter.

The code below sets retention to 90 days. It's easier to manage in a small custom plugin that survives theme changes (for example, wp-content/plugins/my-simple-history-settings/my-simple-history-settings.php) than in your theme's functions.php.

<?php
/*
 * Plugin Name: My Simple History Settings
 * Description: Changes Simple History's retention period and who can view the log.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// Keep the log for 90 days
add_filter( 'simple_history/db_purge_days_interval', function ( $days ) {
    return 90;
} );

A longer retention period makes the database larger. On sites that log a lot of failed logins, weigh both the retention period and the database size.

Step 4: Limit who can view the log

By default, users with the edit_pages capability (Editor and above among the standard roles) can view the log. IP addresses are shown only to administrators. To show the log to administrators only, change the required capability with a filter. Add this to the plugin above:

// Only users with the manage_options capability (administrators) can view the log
add_filter( 'simple_history/view_history_capability', function ( $capability ) {
    return 'manage_options';
} );

Step 5: Export the log and check it from the command line

From the admin area you can export the log as CSV or JSON. If WP-CLI is available on the server, you can list and export entries from the command line too.

# Show the 20 newest entries as a table
wp simple-history event list --count=20

# Search for failed logins
wp simple-history event list --search="failed" --count=50

# Export to CSV from a given date
wp simple-history event list --date_from="2026-11-01" --count=1000 --format=csv > history.csv

--format accepts table (the default), json, csv and yaml. For the other filter options, run wp help simple-history event list.

Things to keep in mind

• Personal data. The log contains usernames, email addresses and IP addresses. Simple History masks the end of IP addresses before storing them (the last number for IPv4, the second half for IPv6), but combined with the rest of the record they can still identify a person. Mention the activity log in your privacy policy. Simple History adds suggested wording to "Settings" → "Privacy" → "Policy Guide."
• The log lives in the same database. If someone takes over an administrator account, they may delete or alter the log too. If you also want it for investigating intrusions, keep web server access logs separately or consider a way to send logs off-site (such as the premium version's log forwarding).
• Protect logins as well. A log is only a record. If you see many failed logins, harden the login with attempt limits and two-factor authentication. See Protecting against brute-force attacks for how.

Summary

• WordPress core doesn't log actions, so use a plugin such as Simple History.
• Once activated, you can see the list of actions in the sidebar menu and on the Dashboard, and filter by user, date and keyword.
• Retention is 30 days by default. Change it with the simple_history/db_purge_days_interval filter.
• Limit who can view the log with the simple_history/view_history_capability filter.
• Use wp simple-history event list in WP-CLI to list entries and export them to CSV.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)