Who Changed It vs WP Activity Log: which activity log fits your site?

Checked against WP Activity Log's WordPress.org listing and Who Changed It 0.9.0 on 25 September 2026. Plugins change; if something here is out of date, tell us.

At a glance

	WP Activity Logby Melapress	Who Changed It
Active installs	300,000+	About 90 active installs — first released August 2026
What it records	Posts, taxonomies, widgets, menus, users, logins, settings, plugins and themes, database table changes, site files, and multisite networks. Its listing names integrations for WooCommerce, Yoast SEO, Rank Math, WPForms, Gravity Forms, ACF, MainWP, ManageWP and more.	49 event types in ten families: logins, users and roles, content and media, plugins, themes, core and the file editor, a curated list of sensitive settings, WooCommerce, and Yoast SEO / ACF / Elementor. No comments, menus, widgets or taxonomies yet.
Severity	Every event ID has a fixed severity: critical, high, medium, low or informational.	Every event is graded normal, strange or dangerous, then escalated by context — a login at 03:00, an IP never seen for that user, five failed logins from one IP, a burst of deletions — with the reason written on the row.
Tamper evidence	Not described on its listing. The premium edition can store the log in an external database or mirror it to log services, which keeps a copy out of an attacker's reach.	Hash-chained records (HMAC-SHA256). Editing or deleting a row outside the plugin shows up on verification; retention purges and GDPR erasure leave a recorded, verifiable gap.
Notifications	Email, SMS and Slack notifications are in the premium edition.	Free: immediate email on dangerous events, plus native Slack, Discord and Telegram forwarding, and an optional daily or weekly digest.
Reports and export	HTML and CSV reports are in the premium edition.	Signed CSV and JSON evidence export with a manifest stating the filter used.
Multisite	Yes, including network-level events.	Not supported.
Extras	Premium: see who is logged in right now, log users out, add notes to entries, archive to another database, mirror to AWS CloudWatch, Loggly, Papertrail and others.	One action and eight filters. No REST API or WP-CLI commands, and no record of whether a change came from WP-CLI, REST or cron (such changes show as “no user”).

Where WP Activity Log is strong

WP Activity Log has been the default answer to "which audit log plugin?" for years, and it earned that. Its event catalogue is enormous, with a long, documented list of event IDs, and it reaches places a young plugin does not: multisite networks, file changes on disk, database tables being added or dropped, menus, widgets and taxonomies. Its third-party list is the longest of any plugin in this category, covering form builders, membership plugins, LMSs and site-management dashboards.

Its premium edition is aimed at organisations: live session management (see who is logged in, log them out), scheduled reports, and mirroring the log to external systems such as a SIEM or a log service. Getting the log off the server entirely is the strongest defence against an attacker editing it, and WP Activity Log is the plugin in this list most built for it.

Where Who Changed It is different

Who Changed It records far fewer things, and spends its effort on reading them. Both plugins grade severity, but differently: WP Activity Log assigns each event type a fixed level, while Who Changed It starts from a base level and then escalates it by context — the same login is normal at lunchtime from a known IP and dangerous at 03:00 from an address that user has never used — and it writes down why on the row. The result is a timeline where the two rows that matter are already red.

The other difference is evidence. Every record is hash-chained, so a row deleted or edited in the database is detected rather than silently gone, and exports are signed with a manifest that states exactly what filter produced them. And everything is in the free plugin, including Slack, Discord and Telegram alerts and a daily or weekly digest.

Which one fits you

Choose WP Activity Log if…

you run a multisite network;
you need file-change monitoring or coverage of menus, widgets, taxonomies or many third-party plugins;
you want the log mirrored to a SIEM or log service, or live user session management;
you want the plugin with the longest track record and the most installs in the category.

Choose Who Changed It if…

you want a short, readable log where unusual events are flagged with a reason, not just a severity label;
you may need to prove the log wasn't edited — to a client, a host or an insurer;
you want Slack, Discord or Telegram alerts and a digest without a paid tier;
your site is a single install with WooCommerce, Yoast, ACF or Elementor.

Get it free on WordPress.org →

Not sure? Try the live demo on the homepage, which runs the plugin's timeline on sample data, or read how events are classified.

Common questions

Is WP Activity Log free?

It has a free edition on WordPress.org. Notifications, reports, session management, external databases and log mirroring are listed as premium features; check Melapress's own site for what each tier includes today. Everything in Who Changed It is in the free plugin on WordPress.org.

Can I switch from WP Activity Log to Who Changed It?

Yes, but history does not move across: the two plugins store different data in different tables, and Who Changed It has no importer. The usual approach is to run both for your retention period, then remove the one you are leaving, exporting its log first if you need to keep it.

Does Who Changed It support multisite?

Not yet. If you run a multisite network, WP Activity Log is the one of the two that covers it today.

Which one is lighter on the site?

Both write to their own database tables rather than the options table. Who Changed It watches fewer hooks because it records fewer event types, which is a trade-off rather than a free win: fewer hooks also means less coverage.

Who Changed It vs WP Activity Log