Read and export the activity log

Every sign-in, every block, every plugin activation leaves a row behind. The activity log writes security-relevant events into a database table of its own — with the time in UTC, the event name, the severity, the user, the IP address and a short description.

What gets logged

• Logins and logouts
• Failed sign-in attempts and IP blocks — both only as long as “Login limit active” is switched on
• Manually lifted blocks
• Activated and deactivated plugins as well as theme changes
• Newly created users and changed roles
• Changes to the options siteurl, home, users_can_register, default_role and admin_email
• Published and updated content
• Results of the core check and the malware scan, plus everything to do with two-factor sign-in
• Blocked scanner bots and requests rejected by the bad request filter, provided the two switches under “Hardening” (in German: „Härtung“) are on

Viewing, exporting, clearing

1. In “Kakapo Security”, the “Activity log” (in German: „Aktivitäts-Log“) item sits on the left in the “Log” group.
2. The table shows the 200 most recent events; the number next to it gives the total held.
3. With “CSV export” you download up to 1000 entries as a file — the columns are time, event, severity, user, IP and detail, separated by semicolons.
4. With “Clear” you remove all entries; the action asks for confirmation first and cannot be undone.

The severity is one of four values — info, warn, crit or success — and determines the color of the marker in the event column. All times are given in UTC throughout, not in the time zone of the site.