Exporting the log: CSV and JSON

How to export

On the Activity Log screen, set whatever filters you want — severity, family, event type, user, date range, free-text search — and export as CSV or JSON. The export honours every active filter, including the search box, so what you download is exactly the set of rows you are looking at rather than the whole table.

Files are named who-changed-it-YYYYMMDD-HHMMSS.csv or .json and are streamed as they are generated, in chunks of 500 rows, so exporting a large table will not exhaust PHP's memory limit.

Anyone who can view the log can export it, unless you have switched on the export restriction in settings, which limits it to users who can change the plugin settings.

The columns

Sixteen columns, in this order:

• chain_index — the record's position in the hash chain.
• event_time — when it happened, always in UTC regardless of your display setting.
• severity — normal, strange or dangerous.
• event_type — the machine name, e.g. plugin_deactivated. See the event reference.
• family — one of the nine families.
• object_type — what kind of thing it happened to: plugin, post, user, option…
• object_name — the human-readable label for that thing.
• user_id — the acting user's ID, or 0 for anonymous events such as failed logins.
• user_login — their username at the time.
• ip — the client IP as stored, subject to your privacy mode.
• reasons — the escalation reasons, empty when nothing escalated.
• context — event-specific detail: the changed fields and their old and new values, the option name, the role, and so on.
• redacted_at — set if this record's personal fields were redacted, and when.
• prev_hash, payload_hash, record_hash — the chain hashes that let a recipient verify the file.

In CSV, reasons and context are JSON inside cells. If you plan to process the file programmatically, prefer the JSON export, where they are real nested structures.

Every export is signed

Both formats carry a manifest describing the export — the filters and time bounds, the record count, the chain span, and whether the chain verified at the moment of export — covered by an HMAC-SHA256 signature. Neither the records nor the stated bounds can be altered without invalidating it.

This is what makes a filtered export meaningful to an auditor or an insurer: they can see it was a partial view and exactly which filter produced it, rather than having to trust that nothing was quietly left out. The full verification procedure, which needs no WordPress, is in integrity and evidence.

Why CSV cells sometimes start with an apostrophe

Any value beginning with =, +, - or @ is prefixed with a single quote before it is written. This is deliberate and it is a security measure, not a formatting bug.

Spreadsheet applications treat a leading = as a formula. Since an audit log records attacker-controlled strings — usernames, post titles, option values — an export without this guard would let someone plant a formula in your log and have it execute when you open the file. This is CSV injection, and it is a real technique against exactly this kind of tool. The apostrophe makes the cell a literal string.

Common uses

• A client or auditor report. Filter to a date range, export, hand it over. Timestamps are UTC, the reasons column explains every flagged row, and the signature lets the recipient confirm nothing was edited on the way.
• An incident write-up. Filter to dangerous events across the incident window and you have a timeline with IPs, users and verification state attached.
• Archiving before a purge. If you keep short retention windows for database-size reasons but need longer records for compliance, export before old rows are pruned.

Programmatic access

There is no REST endpoint in version 0.8.0. To collect events as they happen, use the whochita_event_logged hook — see hooks and filters — or read the wp_whochita_log table directly.