Getting started with Who Changed It

Install the plugin

Who Changed It is on the WordPress plugin directory, so the normal route is the fastest one:

1. In wp-admin, go to Plugins → Add New.
2. Search for Who Changed It.
3. Click Install Now, then Activate.

You can also download the ZIP from the plugin page and upload it under Plugins → Add New → Upload Plugin, or drop the folder into /wp-content/plugins/who-changed-it/ over SFTP.

It needs WordPress 6.0 or newer and PHP 7.4 or newer. There is no licence key, no account, and no external service to connect — out of the box the plugin makes no outbound calls at all, and the only thing that ever changes that is you switching on a Slack, Discord or Telegram channel yourself.

What happens on activation

Activation creates one database table, wp_whochita_log (with your own table prefix), and starts recording immediately. There is no setup wizard and nothing to switch on.

Find the log

A new top-level menu item called Activity Log appears in wp-admin (the eye icon, near the bottom of the menu). It has two screens:

• Activity Log — the event list, at admin.php?page=whochita-log. Filter by severity, family, event type, user, date range, or free text.
• Settings — at admin.php?page=whochita-settings. See the settings reference.

Reading the log is its own capability, whochita_view_log. By default administrators have it implicitly, and you can grant it to other roles — or switch to a mode where only the capability counts, so administrators have no access unless it is granted to them.

Reading your first events

Every row carries a severity badge: normal, strange or dangerous. That classification is the point of the plugin — a long list of "post updated" tells you nothing, but three rows the plugin thinks are worth your attention tell you a lot. How that decision is made is documented in how events are classified.

Your very first events will usually be your own: user_login when you signed in, and plugin_activated for Who Changed It itself. If you want to see a diff straight away, edit a post and save it — the resulting post_updated row expands to show which fields changed.

A sensible five-minute setup

The defaults are usable as-is, but four things are worth a look on day one:

1. Where alerts go. Dangerous events email your site's admin address out of the box. If that is not a mailbox you read, set your own recipients — or send them to Slack, Discord or Telegram instead. See notifications and alerts.
2. Retention. The default keeps three months, and each of the nine event families can override that. See retention, IPs and privacy.
3. The chain key. If the log may ever need to stand up as evidence, define WHOCHITA_CHAIN_KEY in wp-config.php before you accumulate records — it moves the tamper-detection key out of the database. See integrity and evidence.
4. Behind a proxy? If your site sits behind Cloudflare, a load balancer or any reverse proxy, every event will show the proxy's IP until you map the real client-IP header. The one-line fix is in troubleshooting.

What it does not do

Worth knowing before you rely on it: this is an audit tool, not a firewall and not a backup. It records changes but never blocks, prevents or reverses them, and it never writes to your content or settings. It also only sees what passes through WordPress — a direct database edit or a file changed over SFTP outside WordPress is invisible to any plugin, including this one.