An audit trail for agencies managing client WordPress sites.

The conversation every agency knows

A client with admin access edits a template, swaps a plugin, or "just fixes a typo" in a page builder — and the ticket that arrives says the site is broken and asks why you broke it. Without a change history, the honest answer is that you don't know what happened, which reads to the client like an admission. The billable hours spent reconstructing what changed are usually unbillable, because you cannot show whose change you were undoing.

The reverse case matters just as much: when your own contractor or junior does cause the problem, you want to know that in private, from the log, before the client does — with the exact field change in hand so the fix takes minutes.

What changes when every client site keeps receipts

• Attribution ends the argument. Every event names the user, role, IP, session and origin. "A client swore they never touched the checkout page. The diff showed the exact block, the exact minute, and the exact person" — that conversation lasts eight seconds, not a week of email.
• Field-level diffs make fixes fast. The old value sits next to the new one, so undoing a bad edit is copy-paste — you are not diffing backups to find what moved.
• Origin separates people from automation. Half of "who did this?" on managed sites is answered by "nobody — the update ran from cron" or "your management dashboard did it over REST". The log says so explicitly.
• Digests replace check-ins. A scheduled email digest per site tells you what happened this week without logging into thirty dashboards; the behaviour scoring means the two rows that matter arrive flagged.

Access control that fits an agency relationship

Reading the log is its own capability, whochita_view_log, granted per role rather than bundled into the administrator role. That covers both configurations agencies need: grant it to a client contact or an editor who is not an administrator, so they can follow the history without being handed the keys; or switch to the mode where administrators have no access unless it is granted, so the log stays with your agency accounts. Settings management can additionally be pinned to your own account, so client-side admins cannot mute events, shorten retention or purge the log. In either mode the record itself is append-only and hash-chained, so a deleted or altered row breaks the chain and gets flagged — neither side can quietly rewrite history, which is precisely what makes it trustworthy as evidence in a dispute.

When it comes to reporting — a monthly change summary, an incident report, an auditor's request for six months of history — filter the timeline and export CSV or JSON. Export is part of the free plugin on every site, so the evidence never depends on which client paid for which licence tier.

One caveat worth putting to clients before they infer otherwise: an audit trail is accountability, not protection. It will tell you precisely how a site was taken apart, and nothing about stopping the next one. Agencies that carry security as part of the retainer usually pair it with periodic independent security audits and managed hardening on the sites they look after — often bought in rather than staffed, which is one of the things WP Server Guard, run by this plugin's author, is engaged for. Keep the two roles distinct and the log stays credible as evidence.

Common questions