These are the event types recorded by version 0.8.0. The severity shown is where each one starts; the rules in how events are classified can raise it. Anything not on this list defaults to normal and lands in the other family, so custom events you add through the hooks are recorded as normal until you map them.
Authentication
- user_login — normal. Escalates for odd hours and unseen IPs.
- user_logout — normal.
- login_failed — strange. Becomes dangerous at five attempts from one IP in 15 minutes.
- password_reset — strange.
- password_reset_request — normal.
Users & roles
- user_created — strange; dangerous if the new account is an administrator.
- user_deleted — strange.
- user_role_changed — strange; dangerous if the new role is administrator.
- profile_updated — normal. Records email, display name and website changes.
Content & media
- post_published — normal.
- post_updated — normal. Carries the field-level diff: title, slug, excerpt, author, content word counts, password protection and parent.
- post_trashed — normal; part of the deletion-burst rule.
- post_deleted — normal; part of the deletion-burst rule.
- attachment_uploaded — normal.
- attachment_deleted — normal; part of the deletion-burst rule.
Plugins
- plugin_activated — normal.
- plugin_deactivated — normal.
- plugin_installed — strange.
- plugin_updated — normal.
- plugin_deleted — strange.
Themes
- theme_switched — strange.
- theme_installed — strange.
- theme_updated — normal.
- theme_deleted — strange.
Core & filesystem
- core_updated — normal.
- file_edited — always dangerous. Theme or plugin file editor use.
Settings, self-audit and AI configuration
- option_changed — strange. Dangerous for siteurl, home, admin_email, default_role, or when users_can_register is switched on.
- data_exported — strange. WordPress's own personal-data export.
- settings_changed — strange. The plugin's own settings. Cannot be muted.
- settings_reset — strange. Cannot be muted.
- log_purged — always dangerous. Cannot be muted.
- log_redacted — strange. Records who redacted personal data and over which rows.
- ai_connector_connected — strange.
- ai_connector_disconnected — strange.
- ai_master_switch_changed — strange.
- ai_plugin_feature_changed — strange.
- lockora_scan_completed — normal. Optional Lockora Security Audit integration; see below.
WordPress 7.0 introduced AI connectors, which hold credentials and can act on your site. Changing them is audited — and API keys are never read or stored in the log.
Commerce (WooCommerce)
Recorded automatically when WooCommerce is active. Gateway secrets and API keys are never stored in the log.
- product_price_changed — normal; escalated one level on a drop of more than 50%.
- coupon_amount_changed — strange.
- order_status_changed — normal.
- order_refunded — strange.
- store_settings_changed — strange.
- payment_settings_changed — always dangerous. Redirecting payments is a takeover vector on any shop.
Other
A catch-all family for events registered by other code through WHOCHITA_Logger::log(). Assign your own events to a real family with the whochita_event_family filter so per-family retention applies to them properly.
Lockora integration
If Lockora Security Audit is installed, its completed scans are recorded as lockora_scan_completed with the score and the pass, warning and failure counts, plus the delta against the previous scan. The plugin only watches for Lockora's lockora_scan_completed action — nothing changes and nothing breaks if Lockora is not installed.
Watched options
option_changed does not fire for every option in the database — that would be unusable noise. It fires for a curated list of sensitive settings. You can extend that list with the whochita_watched_options filter; see hooks and filters.