WP Activity Log Review: Forensic Auditing With an Enterprise Tax

WordPress core has no concept of accountability. If an editor accidentally wipes a page, an administrator installs an unvetted plugin, or brute force cracks an account, the native dashboard tells you nothing about who did it, when, or what changed.

WP Activity Log, built by Melapress (formerly WP Security Audit Log), has been the default answer for over a decade. With over 300,000 active installations, it is the standard recommendation in WordPress communities. But while it does its job thoroughly, it comes with a steep pricing ladder, database maintenance realities, and tier restrictions you should understand before buying.

The Free Core vs. What Melapress Paywalls

The free edition on WordPress.org is unusually generous where it counts: logging volume. Unlike freemium plugins that cap history at 50 events or seven days, Melapress leaves the core engine unrestricted. It tracks changes to posts, pages, user profiles, plugins, themes, and settings, attaching a numerical Event ID, timestamp, IP address, and user role to every entry.

The wall goes up when you need to search or act on that data. Melapress locks search filters behind paid plans, meaning free users with 50,000 events must page through tables manually. Real-time session management is also gated: you cannot see who is currently logged in, kick out suspicious sessions, or enforce idle timeouts without a license. The same paywall applies to automated PDF or CSV reports and instant notifications over email, SMS via Twilio, or Slack.

Premium pricing starts at $139 per year for a single site, climbing to $249 for 5 sites and $349 for 10 sites. Melapress sells annual licenses only, with no monthly billing option.

The Database Reality (and What Reddit Gets Right)

In r/Wordpress threads, developers frequently recommend WP Activity Log whenever someone asks how to track down "who broke what." But those recommendations almost always come with a warning about database bloat.

The plugin records activity directly into dedicated tables (wp_wsal_occurrences and wp_wsal_metadata). On a busy WooCommerce store or a site with multiple daily contributors, these tables can easily accumulate hundreds of thousands of rows within months. If you leave the plugin on default settings, database backups swell fast.

The practical fix is configuring the built-in retention policy to prune logs older than 30 or 60 days right after activation, and disabling tracking for noisy background tasks. Also note what Reddit users frequently have to remind site owners: WP Activity Log cannot inspect the past retroactively. It only logs events that occur after activation.

The SIEM Paywall and the Multisite Trap

For strict compliance frameworks like HIPAA or PCI-DSS, keeping audit logs on the same server as the WordPress site is a liability. If an attacker gains administrator access, they can alter or delete local tables to cover their tracks.

Melapress restricts external log storage to its Enterprise tier ($189 per year for a single site, or $299 for up to 5 sites). The Enterprise plan lets you mirror or offload logs entirely to external MySQL databases, Syslog, AWS CloudWatch, Loggly, or Splunk. If your compliance officer requires tamper-evident, centralized log forwarding, the $139 Premium tier is useless; you must pay the Enterprise rate.

Multisite networks run into another licensing catch. Melapress counts every sub-site in a network against your license quota, not just the root network install. If you run a network of 15 sub-sites, you cannot use the $139 single-site license; you are pushed into the 25-site tier at $449 per year on Premium or $499 per year on Enterprise.

Who Should Pick It, Who Should Skip It

If you run a personal blog or a solo project where you are the sole administrator, skip WP Activity Log entirely. For a single user who just wants to verify when a plugin updated or when a draft changed, Simple History is lighter, completely free, and avoids dedicated database bloat. WP Activity Log is also a poor fit if you need a temporary audit tool for a two-week troubleshooting job, simply because Melapress refuses to sell monthly access.

Where the plugin earns its price tag is on multi-user business sites, client builds managed by agencies, and sites subject to compliance rules. Being able to terminate active sessions remotely, receive immediate Slack alerts when an admin account is created, and forward tamper-evident logs to AWS CloudWatch solves genuine operational risks. Just make sure to budget for the $189 Enterprise tier if off-site logging is required, and configure your retention pruning on day one.