=== Activity Track – User Activity Log & Security Monitor ===
Contributors: ujimoto
Tags: activity log, user activity log, audit log, security monitor, login log
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.2.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

User activity log and security monitor: track logins, edits and admin actions, detect suspicious sign-ins and 404 scans, and get email alerts.

== Description ==

**Activity Track – User Activity Log & Security Monitor** records what happens on your WordPress site and tells you when something needs your attention. See who changed what, spot suspicious sign-ins and scanning attempts, and follow WooCommerce payment problems, all in a clean, modern dashboard.

Most activity logs only list events. Activity Track also connects related events into **Incidents**, so you see one clear story ("5 failed sign-ins, then a successful sign-in, then a new administrator") with the reason it was flagged and what to check next. Activity Track Pro adds AI explanations with no API key needed.

= What you get for free =

* **User activity log**: logins, logouts and failed logins; post and page edits; plugin and theme changes; user and role changes; media; settings; menus, widgets and comments.
* **Security incidents**: warnings for a successful sign-in after repeated failed attempts, new administrator access, and sensitive changes made soon after a flagged sign-in.
* **404 monitoring and scan detection**: see every missing page, and get an incident when a visitor probes for sensitive files such as `.env` and backups, or scans for vulnerable scripts.
* **WooCommerce activity**: orders, status changes and refunds, plus checkout and Stripe payment outcomes with decline reasons.
* **Email alerts**: notification rules for selected activities and users, and alerts for high priority incidents.
* **Search, filters and CSV export** for audits and troubleshooting.
* **Privacy-first**: incident evidence never stores raw IP addresses, passwords or typed usernames, and personal-data export and erasure are supported.
* **Multisite compatible.**

= Who it's for =

* **Site owners** who want to know when something unusual happens.
* **Agencies** managing client sites and needing a clear record of changes.
* **WooCommerce stores** that need to understand failed payments and customer account activity.
* **Content and security teams** that need accountability.

= Why Activity Track =

* **Explains, not just lists**: incidents group related activity and suggest what to check.
* **A useful free version**: incidents, 404 scan detection and WooCommerce payment insights are included in Free.
* **Monitoring only**: it never blocks visitors or changes your site, so it works alongside your firewall or security plugin.
* **Simple, modern interface** that fits the WordPress admin.

[Activity Track Pro](https://activitytrack.ai) adds AI explanations, extra incident checks, longer history and priority support.

= WooCommerce Activity (Free) =

Connect recorded account activity, checkout submissions, saved payment methods, and payment outcomes in one timeline. Includes customer/order summaries, grouped profile updates, outcome badges, and links to related timelines.

* Enable **WooCommerce** under **Activity Track → Settings → Enable Activity Types** to show the WooCommerce Activity menu. Enable **User** to record registration, sign-ins, and profile changes.
* Supported Stripe events are collected through the WooCommerce Stripe gateway. Live webhook recording is shown separately from WooCommerce payment completion; an unconfirmed webhook does not mean a payment failed.
* Review notices highlight five or more recorded live Stripe payment/card-setup failures for the same linked user within ten minutes. Failures can be legitimate retries and do not prove fraud.
* Profile changes store allowlisted categories, not field values. Older events may not contain changed-field details.
* Summaries cover the events on the current page. Tracking starts when enabled; missing records do not prove no activity occurred.
* Monitoring only: this feature does not block customers, validate cards, or replace WooCommerce order management or payment-provider fraud controls. No raw card details or payment payloads are stored by this recorder.

Free works independently. Pro is optional and requires the Free plugin to remain installed and active.

= Incidents (Free) =

Review security warnings in **Activity Track → Incidents**, the second tab beside Activity Log. Turn on monitoring in **Monitoring settings**; it is off by default.

* Flag a successful sign-in after at least five failed attempts targeting the same existing account within fifteen minutes, with the successful sign-in inside the thirty-minute detection window.
* Flag new administrator accounts and administrator role grants. A flagged sign-in becomes high priority if the same account grants administrator access, activates a plugin, or changes a monitored registration, role, site URL or administrator email setting within one hour.
* Check your own site once a day for sensitive files that must never be public (.env, Git data, wp-config backups, debug.log, database dumps, site archives). Only files that exist on disk are requested, content is verified, and each exposed file opens a high priority incident. **Check now** re-runs this check.
* Flag signed-in accounts that probe for hidden files (high priority). Anonymous bot scans that only receive 404 responses found nothing, so they are counted in a daily summary on the 404 Errors page instead of opening incidents. These checks require 404 Errors tracking to be enabled.
* Filter by status, priority and date; search incidents; and open a detail dialog with the evidence timeline, reason for the warning and suggested checks.
* Resolve incidents as Addressed, Expected activity or False alarm, with an optional note. Configure email alerts for high priority findings and administrator grants, with review-only alerts optional.
* Select individual open incidents or all open incidents on the current page and apply one resolution together. Already-resolved incidents retain their existing resolution; current filters are preserved.
* Checks run locally in bounded background batches, scheduled about every five minutes through WordPress Cron. Use **Check now** for a manual run. Scheduling depends on site traffic or a configured cron runner.
* Account checks use account IDs. 404 checks use a daily salted visitor fingerprint; incident evidence does not store raw IP addresses, passwords or attempted usernames. The separate source logs retain their own privacy settings. WordPress personal-data export and erasure are supported.
* Resolved incidents are kept for thirty days in Free. Incident evidence is retained separately from the source logs.
* Monitoring starts when enabled. Warnings indicate activity to review, not proof of compromise; this feature does not block requests or change accounts, plugins or site settings.

An activated Pro license adds a high priority incident when a visitor that scanned the site (including plugin and theme discovery scans) also tries to sign in, optional AI explanations and ninety-day retention for resolved incidents.

= 404 Errors (Free) =

Review final front-end 404 responses in **Activity Track → 404 Errors**, with requested URLs, referrers, device information, and recorded visitor details.

* Tracking is enabled by default. Turn it off under **Activity Track → Settings → Enable 404 tracking**.
* Search recorded URLs, filter by date, export CSV, and delete selected records.
* The Source column explains recorded same-site, search-engine and external referrers. Without a referrer, it describes sensitive-file probes, script probes, detected bots, or direct/unknown requests. Recorded headers are clues, not verified attribution.
* Open a related incident directly from a linked 404 row. CSV exports include Source beside the retained Referrer URL.
* URL query values are redacted. Capture does not perform remote location lookups and respects the IP logging setting.
* Recording is limited to 60 per minute and 5,000 per day. At 10,000 stored records, the oldest 1,000 are deleted in a batch before adding more. Age-based retention still applies (30 days by default).
* Pause or resume recording directly on the 404 page. Existing records remain accessible while paused; automatic retention cleanup continues. Recording status shows active, paused, or capture-limit states. Skipped responses are not backfilled.
* Bot labels use User-Agent automation signals. Unrecognized clients probing PHP files in common scanner targets are labeled **Suspected bot**. Labels apply to existing records and CSV exports; they do not verify identity or block requests.
* Monitoring only: this feature does not redirect URLs or block requests. Earlier 404 responses are not backfilled.

== External Services ==

For IP location labels in the main activity log, the plugin may send an IP address to one of the following HTTPS services when displaying the log and a cached location is unavailable. Requests also include the site's WordPress version in the User-Agent header. Event recording uses cached locations only and does not perform remote location lookups. The 404 recorder does not make these requests either.

* **IP2Location.io**: https://api.ip2location.io/ — [Terms](https://www.ip2location.io/terms-of-service) and [Privacy](https://www.ip2location.io/privacy-policy).
* **IPinfo**: https://ipinfo.io/ — [Terms](https://ipinfo.io/terms-of-service) and [Privacy](https://ipinfo.io/privacy-policy).

Free works without the optional Pro service. Pro features are provided by a separate plugin; review its service disclosures before enabling them.

IP recording uses the connecting address (`REMOTE_ADDR`) by default. Forwarded IP headers are accepted only from proxy addresses explicitly configured through the `atkai_trusted_proxies` filter. Sites behind a proxy or CDN must configure trusted proxy addresses to retain forwarded visitor IPs in the main activity log.

== Pro Features (Optional Upgrade) ==

* 🛡 **Incident Investigation**: Add plugin/theme discovery checks, scan-to-sign-in correlation, optional AI explanations of incident evidence, and ninety-day resolved-incident retention with an activated Pro license.

* 🤖 **AI-Driven Summaries**  
  Request a structured explanation of a recorded log, with a summary, impact, suggested next steps, and limits of the available evidence.

* 🌐 **VPN & Proxy Detection**  
  Automatically flag or exclude traffic coming from known VPNs, proxies or TOR nodes.

* 🔒 **IP Anonymization & Hashing**  
  Meet GDPR/CCPA requirements by masking or hashing visitor IP addresses.

* 🗂️ **Grouped Activity Logs**  
  Consolidate repeated events into single entries with frequency counts for cleaner analysis.

* ⏱ **Advanced Time Filters**  
  See data for the last 24 hours, 7 days, 30 days or any custom interval.

* 🚨 **Unlimited Notification Rules**  
  Create as many email notifications as you need—no caps.

* 🛠 **Priority Email Support**  
  Get fast, expert help whenever you need it.

== Installation ==

1. Upload the `activity-track` folder to `/wp-content/plugins/`.  
2. Activate **Activity Track** via the **Plugins** screen in WordPress.  
3. Go to **Activity Track → Settings** and configure your tracking preferences.  
4. (Optional) Upgrade to **PRO** on our [pricing page](https://activitytrack.ai/pricing/) to unlock AI summaries, VPN detection, unlimited rules, and more.

== Source Code & Human-Readable Files ==

We include both the original (human-readable) and the minified assets in this ZIP so you can review or fork them directly.

— **JavaScript sources** (in `assets/admin/js/`):  
  • `flowbite.js`  
    – original Flowbite source (upstream: https://github.com/themesberg/flowbite)  
  • `flowbite.min.js`  
    – minified Flowbite  
  • `atk.notifications.js`  
    – our plugin’s notifications logic (un-minified)  
  • `atk.settings.js`  
    – our plugin’s settings page logic (un-minified)

— **CSS sources** (in `assets/admin/css/`):  
  • `tailwind-admin.css`  
    – compiled Tailwind CSS for admin pages (un-minified)  
  • `atk.custom.css`  
    – plugin custom overrides (un-minified)  
  • `atk.notifications.css`  
    – notification panel styles (un-minified)  
  • `atk.settings.css`  
    – settings page styles (un-minified)

— **Production assets enqueued** by the plugin:  
  • all `.min.js` files from `assets/admin/js/`  
  • all `.css` files from `assets/admin/css/`

== Frequently Asked Questions ==

= Will this slow down my site? =
No. The activity logger is optimized to be lightweight. It writes concise entries and uses indexed database tables to keep reads fast, so typical sites will not notice any performance impact.

= What events does the activity log record? =
Logins/logouts, failed logins, post and page edits, plugin/theme activation or updates, user/role changes, media uploads/deletions, and key settings updates. You can filter or export the audit trail as needed.

= Where are the logs stored? =
Logs are stored in your WordPress database. You control retention via settings; export to CSV is available for audits and compliance.

= What versions of WordPress and PHP are supported? =  
Requires **WordPress 6.4+** and **PHP 8.0+**. See the readme header for the tested WordPress version.

= How do I upgrade to the PRO features? =  
Install and activate Activity Track Pro, then visit **Activity Track → Settings → Pro Settings**, enter your license key, and unlock AI summaries, VPN/Proxy detection, and unlimited notification rules.

= Can I track activity across a multisite network? =  
Yes! The plugin is built to support multisite. Install network-wide or enable on individual sites as needed.

= Does it detect hacking attempts or brute-force logins? =
Yes. Turn on monitoring in **Activity Track → Incidents** to get warnings for a successful sign-in after repeated failed attempts, new administrator access, sensitive changes after a flagged sign-in, and 404 scans for sensitive files or vulnerable scripts. Warnings show what to review; they are not proof of a compromise.

= Does it block attackers? =
No. Activity Track is monitoring only, so it never blocks visitors or changes settings. Use it alongside your firewall or security plugin, which can block a client you identify in an incident.

= Do I need an AI or OpenAI API key? =
No. The free plugin does not use AI. Activity Track Pro includes AI explanations without needing your own API key.

= Is user data stored safely? =  
We respect privacy—IP anonymization, hashing, and GDPR/CCPA compliance options are available in Pro Settings.

== Screenshots ==

1. **Dashboard Overview** — live-feed User Activity Log of recent actions and events.  
2. **Notification Rules** — build custom triggers by role, action.  
3. **Notification Report** — view activity notifications reports.
4. **Settings** — configure tracking options, IP anonymization, and more.
5. **404 Errors** — view and manage 404 error logs with optional Pro grouping and bot filters.
6. **WooCommerce Activity** — view and manage WooCommerce-specific activity logs.
7. **Incidents** — security warnings grouped into clear stories, with priority and status.
8. **Incident details** — evidence timeline, why it was flagged and what to check next.

== Changelog ==

= 1.2.5 =
* Incidents now focus on findings that need action: anonymous 404 scans that only received "not found" no longer open incidents. They are counted in a daily scanner summary on the 404 Errors page, and existing scan-only incidents are resolved automatically once.
* Added a daily self-check for sensitive files that are publicly accessible on your site (.env, Git data, wp-config backups, debug.log, database dumps and site archives), with content verification and a high priority incident per exposed file. Check now also runs it.
* Signed-in accounts probing for hidden files, and (Pro) scanners that then try to sign in, still open high priority incidents.
* 404 Source: a referrer equal to the requested page is no longer reported as a broken link; added Contact-page guess and Rapid crawler labels; IPFS gateway probes count as script probes.
* 404 User Location shows the cached location or a masked IP (for example 203.0.113.x) instead of only the IP version.
* Replaced the repetitive 404 Referrer URL display with a Source column showing same-site links, search engines, external sites, probes, bots or direct/unknown requests from the recorded evidence.
* Added related incident links to 404 rows and a matching Source field in CSV exports, retaining the raw Referrer URL field.
* Added checkbox selection and bulk incident resolution as Addressed, Expected activity or False alarm. Select all applies to open incidents on the current page; previously resolved incidents are unchanged.
* Preserved filters after bulk resolution, refreshed incident counts, and applied the existing permission, nonce, audit-author and Free/Pro retention rules.
* Fixed incident dialogs reopening after unrelated plugin refresh or dismiss links retained an old incident URL.
* Added direct-access guards, translator context and explicit output escaping; corrected release documentation and the WooCommerce integration test's empty-table assertion.

= 1.2.4 =
* Added the Incidents tab beside Activity Log, with opt-in local background monitoring and a manual Check now action.
* Added warnings for successful sign-ins after repeated failed attempts and new administrator access.
* Added high priority escalation when a flagged account subsequently grants administrator access, activates a plugin or changes a monitored sensitive setting.
* Added 404 incident checks for sensitive-file probes, bursts of script requests and signed-in accounts probing hidden files, using daily anonymous visitor fingerprints.
* Added incident search, status/priority/date filters, monitoring settings, evidence timelines and suggested investigation steps in a detail dialog.
* Added configurable incident email alerts, resolution outcomes and optional notes, automatic resolution of quiet review-only 404 incidents, and thirty-day resolved-incident retention in Free.
* Added bounded incident capture and processing, separate retained evidence, storage/capture status notices, and WordPress personal-data export and erasure support.
* Added integration with licensed Pro incident checks, scan-to-sign-in correlation, AI explanations and ninety-day resolved-incident retention.
* Improved visitor/client labels and icons in 404 Errors and Incidents.
* Standardized search field heights and font sizes, search placeholders, Reset Filters buttons and icons across the activity tabs.
* Added always-visible View incident links, text-only hover underlines, colored incident status labels and consistent resolution field typography.

= 1.2.3 =
* Added username and display-name search; exact usernames return that user's activity logs.
* Improved empty results with clear messages, visible table controls and a Reset Filters action.

= 1.2.2 =
* Redesigned WooCommerce Activity with a compact table, filters, pagination and clearer results.
* Added order/customer History and event Details, preserving payment attempts and separate live/test history.
* Added optional Pro order grouping with latest matching events and counts.
* Kept WooCommerce views and histories commerce-focused; general logins remain in Activity Log.
* Added Pro 404 grouping, consolidated Event controls and bot filters for views and exports.

= 1.2.1 =
* Prevented recursive API logging and excluded internal geolocation requests from API logs.
* Redacted API URL query values and credentials; failed-login usernames are now displayed as text.
* Removed remote geolocation calls from event recording, restricted lookups to HTTPS, and fixed failed-lookup warnings.
* Restricted custom styles to Activity Track admin pages and added authorization and failure handling to report deletion.
* Removed redundant query preparation notices and disabled autoloading for updated notification counters.
* Forwarded IP headers now require explicitly trusted proxy addresses; otherwise the connecting IP is recorded.
* 404 tracking remains enabled by default on upgrades unless disabled in Settings; existing capture and storage limits apply.
* Added Pause/Resume recording controls to the 404 Errors page while keeping existing records accessible.
* Added a 10,000-record limit for 404 storage, deleting the oldest 1,000 records per batch before adding more.
* Added Bot and Suspected bot device labels to new and existing 404 records and CSV exports.
* Added colored recording-status badges, play/pause button icons, and clearer pause and capture-limit notices.
* Added a Select All header checkbox to the 404 Errors table for bulk deletion.
* Updated 404 pagination to match Activity Log, with item totals and first, previous, next, and last page controls.

= 1.2.0 =
* Added a dedicated 404 Errors view for recorded final front-end 404 responses, including requested URLs, referrers, and device information.
* Added 404 URL search, date filters, CSV export, and selected-record deletion.
* Added query-value redaction, bounded recording volume, and automatic cleanup using the configured retention period for 404 records.
* Added collapsible overview panels for WooCommerce Activity and 404 Errors.
* Updated release documentation and packaging instructions for the WordPress Plugin Directory.

= 1.1.0 =
* Added WooCommerce Activity in Free: account, checkout, saved payment method, and payment-outcome records with customer/order summaries.
* Added recording-coverage indicators and separate WooCommerce and Stripe webhook evidence.
* Added review notices for repeated recorded live Stripe failures, webhook replay deduplication, and separate test-mode labeling.
* Added privacy-conscious profile-change categories and grouped display with individual evidence preserved.
* Improved activity-table readability, event counts, unknown-user labels, and related URL buttons.
* Fixed CSV export submission and missing Activity values that misaligned exported columns.
* Improved compatibility with Pro log explanations and independent Free/Pro loading.

= 1.0.8 =
* Fixed WooCommerce order status changes not always being logged from the admin order edit screen.
* Improved WooCommerce tracking reliability when WooCommerce loads after Activity Track.
* Added a fallback for manual WooCommerce status changes on stores using HPOS.
* Improved activity log display by showing completed WooCommerce statuses with a green label.
* Reduced noisy Pro options logs from internal WooCommerce order-edit option updates.

= 1.0.7 =
* Added WooCommerce logging for trashed and permanently deleted orders.
* Fixed missing order links in WooCommerce log entries on stores using High-Performance Order Storage (HPOS).
* Fixed draft WooCommerce orders being logged as new orders (unfinished checkouts and unsaved admin orders are now skipped).
* Fixed WooCommerce events from payment gateways or cron being misattributed to the customer instead of the system.
* Fixed duplicate log entry when a full refund also changed the order status.

= 1.0.6 =
* Fixed tooltip display issue in the activity log.

= 1.0.5 =
* Added 'Options' and 'WooCommerce' activity types for better tracking.
* Improved activity log formatting for new activity types.

= 1.0.4 =
* Fixed UI issue in settings.
* Improved UI on notifications. 

= 1.0.3 =
* Fixed UI issue on notifications.

= 1.0.2 =
* Fixed multisite compatibility issues.
* Fixed plugin activation/deactivation time out errors.

= 1.0.1 =  
* UI improvements for settings and notifications.  

= 1.0.0 =  
* Initial stable release.  
* Core real-time tracking, logging, and notifications.  

== Upgrade Notice ==

= 1.2.5 =
Adds clearer 404 Source labels, related incident links and Source in CSV exports. Resolve selected open incidents together using one resolution. Fixes unexpected incident dialog reopening and improves checkbox and count-badge consistency.

= 1.2.4 =
Adds opt-in Incidents monitoring for suspicious sign-ins, administrator access and 404 scans. Open WordPress admin after updating, then enable monitoring in the Incidents tab. Enable 404 tracking for scan checks. Earlier account activity is not backfilled.

= 1.2.3 =
Search Activity Log by username or display name. Empty searches now retain the controls and offer Reset Filters. Existing logs remain unchanged.

= 1.2.2 =
WooCommerce Activity now uses a table with order and customer history modals. Existing retained events remain available. 404 bot filters change the view only; bot requests continue to be recorded.

= 1.2.1 =
404 storage now deletes the oldest 1,000 records at the 10,000-record limit. Export records you need to preserve before updating. Pause/Resume controls stop new recording while keeping existing records accessible; age-based cleanup continues.

= 1.2.0 =
Adds 404 error tracking, enabled by default. Open WordPress admin after updating to initialize storage. Disable it in Activity Track settings if unwanted. Existing logs remain available; earlier 404 responses are not backfilled.

= 1.1.0 =
Adds WooCommerce Activity and fixes CSV exports. Update Free before Pro 1.1.0. Open WordPress admin after updating to initialize event storage, then enable WooCommerce and User tracking as needed. Existing logs remain available; historical events are not backfilled.

= 1.0.0 =  
First official stable launch—be sure to back up your settings before upgrading from a dev build.

== License ==

This plugin is released under the [GPLv2 (or later)](https://www.gnu.org/licenses/gpl-2.0.html). Free to use, modify, and redistribute.
