=== Trailmark Activity Log ===
Contributors: alpimobil
Tags: activity log, audit log, security, user activity, audit trail
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Who did what, and when? A fast, privacy-friendly audit log for WordPress. 100% free, in English and Turkish.

== Description ==

Trailmark Activity Log records important administrative activity on your site and shows it in a clean, native-looking screen in your WordPress dashboard.

It answers one question: **"Who did what, and when on my site?"**

* Which user changed which post, and what exactly changed (title, content, status, categories, featured image…)?
* Who deleted a page or moved it to the Trash?
* Which plugin was installed, activated, deactivated, updated or deleted?
* Was a user created or deleted? Did someone's role change from Editor to Administrator?
* Was the theme switched? Was WordPress updated?
* Who logged in, and are there failed login attempts?

Everything is free. There is no Pro version, no license key, no account and no data sent anywhere.

= What is logged =

* **Posts, pages and custom post types:** created, updated (with before/after values), published, unpublished, status changes, trashed, restored, permanently deleted.
* **Media Library:** uploads, edits (title, caption, description, alternative text) and deletions.
* **Users:** created, deleted, role changes, password changes (never the password itself) and email/display name/website changes.
* **Plugins:** installed, activated, deactivated, updated (old and new version), deleted.
* **Themes:** installed, switched, updated, deleted.
* **WordPress core updates**, manual or automatic.
* **Important settings:** site title, URLs, admin email, "Anyone can register", new user default role, permalinks, search engine visibility and more.
* **Logins, logouts and failed logins.**
* **The activity log itself:** changes to its settings, exports, clearing the log, and deactivation of the plugin are always recorded, so nobody can quietly weaken your audit trail.

= Features =

* Native WordPress list screen with filters by user, action, object type and date (today, yesterday, last 7/30 days, custom range) plus search.
* Detail screen for every entry with a clear "Before / After" table of changes.
* "Recent Activity" dashboard widget.
* CSV export (Excel-friendly, protected against formula injection).
* Selective delete: remove only the entries matching the current filters.
* Automatic cleanup: keep logs for 30, 90, 180 days, 1 year, or forever, plus a maximum number of records (50,000 by default).
* Brute-force protection for the log: repeated failed logins are grouped into a single entry with a counter instead of flooding the database.
* Privacy options: full, anonymized or no IP addresses; optional user agent; unknown usernames of failed logins are not stored by default.
* Integrates with the WordPress personal data exporter and eraser.
* Interface in English and Turkish. The language follows WordPress automatically, or you can pick it in the settings. Existing entries are displayed in the chosen language too, because descriptions are generated when they are shown.
* Multisite compatible: each site has its own log.
* Developer friendly: `trailmark_log()` helper and filters such as `trailmark_capability`, `trailmark_should_log`, `trailmark_excluded_post_types`, `trailmark_tracked_options` and `trailmark_trackers`.

= Performance =

* One small INSERT per logged event, nothing else on the front end. Admin screens only load the rows of the current page.
* Changes made to the same object during one request are merged into a single entry, which also avoids duplicate entries from the block editor.
* The settings live in a single autoloaded option; no extra queries per request.
* Old entries are removed in small batches by WP-Cron, so large tables are never locked for long.

== Installation ==

1. Upload the `trailmark-activity-log` folder to `/wp-content/plugins/`, or install the plugin through the **Plugins → Add New** screen.
2. Activate the plugin through the **Plugins** screen.
3. Open **Activity Log** in the admin menu. Adjust what is logged and for how long under **Activity Log → Settings**.

== Frequently Asked Questions ==

= Is it really free? =

Yes. All features are free. There is no paid version.

= Which languages are included? =

The plugin is fully translatable through [translate.wordpress.org](https://translate.wordpress.org/projects/wp-plugins/trailmark-activity-log/), and a complete Turkish (Türkçe) translation is provided by the author there. WordPress downloads the translation for your site language automatically. You can also force English or Turkish for the Activity Log screens under **Activity Log → Settings → Interface language**.

= Who can see the activity log? =

Users with the `manage_options` capability (administrators). Developers can change this with the `trailmark_capability` and `trailmark_manage_capability` filters.

= Are passwords ever stored? =

No. Passwords, password hashes, session tokens and application passwords are never stored. A password change is only recorded as "the password was changed". For failed logins, the submitted password is never read, and usernames that do not belong to an existing account are not stored by default, because people sometimes type their password into the username field.

= Does it slow down my site? =

No noticeable impact. Front-end visitors do not trigger any queries unless they log in or fail to log in. Logging is one small INSERT, and errors while logging are silently ignored so they can never break the action being logged.

= My site is behind Cloudflare or a proxy. The IP address is wrong. =

Go to **Activity Log → Settings → IP address source** and choose Cloudflare or your proxy header. Only do this if a proxy really is in front of your site; otherwise visitors could fake their IP address.

= Can I delete the logs? =

Yes, in two ways:

* **Selective delete:** filter the activity list (for example by action, user, object type or date) and click **Delete filtered entries**. Only matching entries are removed; everything else is kept. To delete everything older than a date, choose the date filter "Custom range" and fill in only the "To" field.
* **Clear everything:** **Activity Log → Settings → Danger zone**.

Every deletion is itself recorded (who, when, how many, which filter). Entries about the activity log itself (settings changes, exports, deletions, activation and deactivation of this plugin) are never removed by selective delete, so the audit trail always shows that something was deleted.

= What happens when I delete the plugin? =

By default, your logs are kept. If you enable **Delete all activity data and settings when the plugin is deleted**, the table and settings are removed when you delete the plugin.

= Can I log my own events? =

Yes:

`trailmark_log( array( 'action' => 'updated', 'object_type' => 'my_thing', 'object_name' => 'Header banner', 'details' => array( 'message' => 'Banner replaced.' ) ) );`

== Privacy ==

This plugin stores activity data in your own WordPress database. It does not send data to any external service.

For each entry it stores: date and time (UTC), the acting user's ID, username and role, the action, the affected object (type, ID, name) and, for updates, the changed values (for long content only a length, a fingerprint and a short excerpt). Depending on the settings it also stores the IP address (full, anonymized or not at all; anonymized by default) and the browser user agent.

Entries are deleted automatically after the retention period you choose (90 days by default), and the oldest entries are removed when the log exceeds 50,000 records (configurable).

The plugin registers a personal data exporter and eraser (Tools → Export/Erase Personal Data). The eraser anonymizes entries (removes the username, IP address, user agent and changed personal values) instead of deleting them, so the audit trail stays consistent. It also adds a suggested paragraph to the privacy policy guide (Settings → Privacy).

This plugin is a technical tool. Whether and how you may store this data depends on your jurisdiction and your use case; please check your own legal obligations.

== Screenshots ==

1. Activity log list with filters.
2. Activity details with before/after changes.
3. Settings.
4. Recent Activity dashboard widget.

== Changelog ==

= 1.1.0 =
* Changed: translations are delivered by translate.wordpress.org language packs instead of being bundled.
* New: selective delete of the entries matching the current filters. Each deletion is recorded; entries about the activity log itself are always kept.
* Changed: the maximum number of records defaults to 50,000 (existing "No limit" settings from 1.0.0 are updated once).
* Changed: destructive buttons are shown in red.

= 1.0.0 =
* Initial release.
