Workspace / Overview
PRO WORKSPACE Local storage

Explore Pro tools

LESS REBUILDING THE SAME REPORT

Set up the review once. Reuse it next time.

Save the filters for a client, store or team review, then schedule private reports from that saved search.

Scheduled reports in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open reports
Included in Free

Filter the activity you need and export a private CSV or JSON record on demand.

Added by Pro

Reuse saved searches and generate private reports on a configured schedule, with optional report-ready notices.

Explore the stepsRead-only example · no site changes
1Save the scope

Choose the evidence and filters that answer your recurring question.

Save that definition so the next review starts from the same scope.
2Set the period

Choose the supported period and inspect the retained evidence it contains.

A structured local summary explains the selected records and their limits.
3Configure the repeat

Choose a daily or weekly schedule and, if needed, report-ready email notices. This example creates no schedule.

Background workers generate private reports. An authorized user still needs to open the report; a notice is not the report itself.

SELECT THE CHANGE AND THE DESTINATION

Get selected alerts where your team works.

Configure an email, Slack or HTTPS webhook destination and choose the supported activity that should trigger an alert.

Advanced alerts in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open advanced alerts
Included in Free

Use the included critical security and failure notices. Routine activity notification emails are in Pro.

Added by Pro

Choose configurable rules and email, Slack or webhook destinations, then review recorded delivery results.

Explore the stepsRead-only example · no site changes
1Choose the change

Select a supported permissions-change event and review the rule conditions.

Start with a change your team needs to review; this example saves no rule.
2Choose the destination

Select an email recipient, Slack incoming webhook or HTTPS webhook you control.

Review the destination and its privacy terms before enabling it. This example makes no connection.
3Verify the result

After setup, check the recorded delivery result and confirm receipt with the intended recipient.

A destination accepting a message does not prove a person received or read it. Background processing must be available.

KEEP THE REVIEW TOGETHER

Pick up the review where you left it.

Keep related evidence, your notes and decisions in one case. Return to it yourself or let an authorized teammate continue.

Cases & handover in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open cases
Included in Free

Find and inspect individual records, including the actor, result and captured differences.

Added by Pro

Review supported associations in one case, add notes, assign the review and retain its decision history.

Explore the stepsRead-only example · no site changes
1Plugin updated

A component update starts the review. Compare the recorded result with your planned maintenance.

A case keeps this record beside the related observations.
2Settings changed

A later configuration change adds context. Its sequence alone does not establish a cause.

Keep the source fact separate from your interpretation.
3Permissions changed

Review the captured role difference and whether the access change was intended.

Record a decision against the case and return to its history.
Also included: review priorities

Inspect an experimental local ranking, its contribution breakdown and evaluation coverage. This experimental ranking helps choose a review order. It is not an attack probability or a verdict.

Availability depends on supported sources and configuration.

YOUR WORDPRESS, UNDERSTOOD

Your review. In context.

View activity
Make this workspace feel like yours.Choose your goal, your experience and the tools that fit.
Personalise my workspace
Display detailReadable stories and guided controls.Changes what you see, not collection, alerts, response or permissions.

Start with what needs your attention.

Review a change, open its evidence, then decide what to do. A finding is something to inspect—not a verdict.

Take a look
Changes to review0In the latest examined activity
Activity examined50Up to 50 recent retained records
Request observations6Within the displayed minute groups
Local responses0Recorded in those request groups

The activity map

See where your WordPress activity happens.

SNAPSHOT
WordPress
50 retained records · sampledClick a node to explore

Activity categories, not network topology. Live mode checks the latest 50 retained events every 10 seconds while this tab is visible. Overview cards remain a separate snapshot.

ACTIVITY ANALYSIS

See the pattern.

Commerce leads this sample, with 28 of 50 records.

50 records
50retained
records
Commerce28 56%
Content17 34%
Users & access3 6%
Site & plugins1 2%
Custom1 2%
50retained
records
10-19 19:00 UTC50 100%
50retained
records
Notice50 100%

This selection only. Recorded hours show occupied UTC buckets, not a continuous traffic trend. Missing activity is not counted.

Your review queue

Significant changes, with the evidence one click away.

View all
No significant changes in this sample.
Missing or older observations are not represented.

Warning, high and critical source severity. Counts cover the latest examined records, not all site activity.

PRO · EXPLAINED PRIORITY

Know where to look first.

50Evaluated
0Pending
0History limit
0Unavailable
  1. 20
    Site configuration changedLow priority · Event #66 · Oct 19 · 19:08
    Why this needs a look
    • A supported site configuration change was recorded. (+20)

    At evaluation: 2026-10-19 19:08:24.039595 +00:00 · priority-v2 · version 1. Source severity: notice. Priority is on a 0–100 product scale, not a probability.

    ip
    not collected by administrative sensor
    geography
    unavailable
    reputation
    unavailable
    login hour
    not applicable
    incident signal
    not applicable
    baseline
    not applicable
  2. 20
    User permissions changedLow priority · Event #64 · Oct 19 · 19:08
    Why this needs a look
    • A site's assigned roles changed. Custom role names alone do not establish privilege level. (+20)

    At evaluation: 2026-10-19 19:08:24.006964 +00:00 · priority-v2 · version 1. Source severity: notice. Priority is on a 0–100 product scale, not a probability.

    ip
    not collected by administrative sensor
    geography
    unavailable
    reputation
    unavailable
    login hour
    not applicable
    incident signal
    not applicable
    baseline
    not applicable
  3. 20
    User permissions changedLow priority · Event #63 · Oct 19 · 19:08
    Why this needs a look
    • A site's assigned roles changed. Custom role names alone do not establish privilege level. (+20)

    At evaluation: 2026-10-19 19:08:23.990877 +00:00 · priority-v2 · version 1. Source severity: notice. Priority is on a 0–100 product scale, not a probability.

    ip
    not collected by administrative sensor
    geography
    unavailable
    reputation
    unavailable
    login hour
    not applicable
    incident signal
    not applicable
    baseline
    not applicable
  4. 10
    Profile changedLow priority · Event #65 · Oct 19 · 19:08
    Why this needs a look
    • A supported administrative observation is available for review. (+10)

    At evaluation: 2026-10-19 19:08:24.023475 +00:00 · priority-v2 · version 1. Source severity: notice. Priority is on a 0–100 product scale, not a probability.

    ip
    not collected by administrative sensor
    geography
    unavailable
    reputation
    unavailable
    login hour
    not applicable
    incident signal
    not applicable
    baseline
    not applicable
  5. 10
    Logged ai pro incident rules changedLow priority · Event #62 · Oct 19 · 19:05
    Why this needs a look
    • Installed extension code supplied this observation; completion is not independently verified. (+10)

    At evaluation: 2026-10-19 19:05:28.764386 +00:00 · priority-v2 · version 1. Source severity: notice. Priority is on a 0–100 product scale, not a probability.

    ip
    not collected by administrative sensor
    geography
    unavailable
    reputation
    unavailable
    login hour
    not applicable
    incident signal
    not applicable
    baseline
    not applicable

Top stored priorities in 50 examined events. 50 evaluated · 0 pending · 0 at history limit · 0 unavailable.

Experimental local scoring helps order a review. It does not establish maliciousness or current conditions.

PRO · CONNECTED EVIDENCE

The story behind the signals.

All cases
  • Staff refund patternInvestigating · Priority 40 · #2
    Open the evidence summary

    Recorded grouping: 5 refunds by the same verified staff actor in 300 seconds. This operational pattern is not a fraud or payment-gateway confirmation.

    Occurrence: 2026-10-19 19:05:26.275505 +00:00 to 2026-10-19 19:05:26.578059 +00:00. Last evaluated: 2026-10-19 19:05:26.689004 +00:00. Source: synthetic_test

    Members: 5 retained · 0 erased · 0 removed by retention · 0 unavailable.

Current open and investigating cases, independent of the selected activity interval. Missing or removed evidence is not represented.

Request signals

Latest retained minute groups

  • Component metadata enumerationOct 19 · 19:04synthetic_test · 0 local responses
    1admitted
  • Component metadata enumerationOct 19 · 19:03synthetic_test · 0 local responses
    1admitted
  • Configuration-resource probe patternOct 19 · 19:02synthetic_test · 0 local responses
    1admitted
  • Configuration-resource probe patternOct 19 · 19:01synthetic_test · 0 local responses
    1admitted
  • Source-control or diagnostic discoveryOct 19 · 19:00synthetic_test · 0 local responses
    1admitted
  • Source-control or diagnostic discoveryOct 19 · 18:59synthetic_test · 0 local responses
    1admitted

Explore request findings

Monitoring status

Some monitoring needs attention. Open System status for details.

  • Activity captureNeeds attention
  • Collectionall supported categories enabled
  • Request visibilityWordPress layer
  • Background workExternal runner unverified
Open system status
About this snapshot & coverage

Site #1 · Network #1 · Display timezone: UTC · Snapshot: 2026-10-19 19:30:00.000000 +00:00

UTC interval: 2026-10-13 inclusive to 2026-10-20 exclusive. Current retention may shorten the available evidence.

Overview counts are bounded samples. Static files, cache hits, upstream traffic, erased records and activity while collection is disabled may be absent. No common actor or successful exploit is inferred.

Older events exist beyond the 50 examined records. The significant-change count is a lower bound.

Partial request analyses: 6 · Unknown final status: 0

Monitoring health

Activity capture
Some activity may be incomplete. Review the explanation below or contact support. Collection: all supported categories enabled
Request visibility
WordPress layer only. Static files, cache hits and upstream responses can be invisible. No recorded request degradation; completeness is not established. Retained admission diagnostics: 0 dropped observations; this is not a total for the selected interval.
Background processing
traffic trigger disabled external runner not verified
Delivery
No recent worker record. A worker return does not prove recipient receipt.
Retention
Activity 90 days; observations 7 days; minute groups 30 days. Activity cleanup: No recent worker record. Request cleanup: No recent worker record.

Last recorded monitoring signals, not a security assessment. A returned worker quantum does not prove completed processing, complete coverage or recipient receipt.

Some activity could not be recorded completely.
Last recorded: . Review details and next steps