Audit history and CSV export require an active Enterprise license. With a Pro license, the Audit controls are disabled; saved settings and existing records are kept. Collection is off by default.
Enable audit history
- Open Audit.
- Select Enable audit history.
- Set the number of days to retain records. The default is 30 days. The permitted range is 1 to 3650 days.
- Save your changes.
The screen shows the latest 50 records. While collection is enabled and the license is active, a daily WordPress task removes expired records in batches. Site traffic or a system task must run WordPress cron.
Recorded events
Records cover completed WordPress logins, failed login or directory checks, role changes, profile updates, account imports, access changes, multisite membership changes, and settings changes.
Each record contains a UTC time, a fixed event name, and actor, user, and site IDs. A directory check that passes before a later login denial does not create a successful login record.
Data kept out of the log
The log excludes passwords, credentials, directory field values, request headers, and attempted account names. It does not give you a list of names tried during failed logins.
Records are private WordPress posts. They have no public page or REST API. Network records stay on the main site and retain the source site ID. Site records remain separate.
Export CSV
Select Export CSV to download all retained records in the current scope, not just the 50 rows on screen. Export requires the settings administrator capability, the correct site or network scope, a valid request, and an active license.
Retention after settings change
Turning collection off or losing the license keeps existing records. An active license is required to view or export records. License expiry stops collection, viewing, export, and scheduled cleanup. Deactivation clears the scheduled cleanup task. Uninstall keeps audit records, WordPress users, and content.
Set a retention period that fits your site's needs. Audit history records plugin events; it is not a complete log of all WordPress activity.
