Workspace / Requests
PRO WORKSPACE Local storage
Display detailReadable stories and guided controls.Changes what you see, not collection, alerts, response or permissions.

Explore Pro tools

LESS REBUILDING THE SAME REPORT

Set up the review once. Reuse it next time.

Save the filters for a client, store or team review, then schedule private reports from that saved search.

Scheduled reports in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open reports
Included in Free

Filter the activity you need and export a private CSV or JSON record on demand.

Added by Pro

Reuse saved searches and generate private reports on a configured schedule, with optional report-ready notices.

Explore the stepsRead-only example · no site changes
1Save the scope

Choose the evidence and filters that answer your recurring question.

Save that definition so the next review starts from the same scope.
2Set the period

Choose the supported period and inspect the retained evidence it contains.

A structured local summary explains the selected records and their limits.
3Configure the repeat

Choose a daily or weekly schedule and, if needed, report-ready email notices. This example creates no schedule.

Background workers generate private reports. An authorized user still needs to open the report; a notice is not the report itself.

SELECT THE CHANGE AND THE DESTINATION

Get selected alerts where your team works.

Configure an email, Slack or HTTPS webhook destination and choose the supported activity that should trigger an alert.

Advanced alerts in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open advanced alerts
Included in Free

Use the included critical security and failure notices. Routine activity notification emails are in Pro.

Added by Pro

Choose configurable rules and email, Slack or webhook destinations, then review recorded delivery results.

Explore the stepsRead-only example · no site changes
1Choose the change

Select a supported permissions-change event and review the rule conditions.

Start with a change your team needs to review; this example saves no rule.
2Choose the destination

Select an email recipient, Slack incoming webhook or HTTPS webhook you control.

Review the destination and its privacy terms before enabling it. This example makes no connection.
3Verify the result

After setup, check the recorded delivery result and confirm receipt with the intended recipient.

A destination accepting a message does not prove a person received or read it. Background processing must be available.

KEEP THE REVIEW TOGETHER

Pick up the review where you left it.

Keep related evidence, your notes and decisions in one case. Return to it yourself or let an authorized teammate continue.

Cases & handover in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open cases
Included in Free

Find and inspect individual records, including the actor, result and captured differences.

Added by Pro

Review supported associations in one case, add notes, assign the review and retain its decision history.

Explore the stepsRead-only example · no site changes
1Plugin updated

A component update starts the review. Compare the recorded result with your planned maintenance.

A case keeps this record beside the related observations.
2Settings changed

A later configuration change adds context. Its sequence alone does not establish a cause.

Keep the source fact separate from your interpretation.
3Permissions changed

Review the captured role difference and whether the access change was intended.

Record a decision against the case and return to its history.
Also included: review priorities

Inspect an experimental local ranking, its contribution breakdown and evaluation coverage. This experimental ranking helps choose a review order. It is not an attack probability or a verdict.

Availability depends on supported sources and configuration.

Requests, in context.

Site 1 · Network 1 · Times shown in UTC

Review admitted request findings and the response recorded for each one. A finding does not establish intent or a successful attack.

Collection coverage and address privacy

WordPress layer only. Bounded configuration, source/diagnostic, traversal-shaped, compound query-shaped, component-metadata and method observations run at init, priority -999. Static files, cache hits, upstream responses and code that bypasses WordPress are not observed.

IP mode: masked. The default source is the direct peer. Forwarding is interpreted only through an explicitly configured trusted-proxy boundary. Source derivation and quality are shown with evidence. Exact-source policies require current full-mode evidence. A shared network address does not identify a person. Bodies, full queries, cookies and authorization headers are never retained. Query policies store only deliberately selected allowlisted numeric conditions.

Request retention: 7 days · Groups: 30 days

Cleanup and telemetry limits

Cleanup runs in batches of 500 per hourly WP-Cron run; delayed cron can leave a backlog. Last successful cleanup: not yet observed. Admission caps and policy expiry do not depend on cleanup.

Every retained row is an admitted observation, not a count of attackers or all traffic. The separate Logged.ai Pro add-on supplies server-log import. Retained imported findings remain readable here.

Request source and observer self-test

Filter requests

Leave a field empty for all values. Status accepts unknown, a class such as 4xx, or an exact code. Blocked by Logged requires a recorded local response; an external 403 alone does not qualify. Dates include the whole UTC day.

Source matching uses available retained context: a full address needs full privacy mode and sensitive-context permission; masks use IPv4 /24 or IPv6 /48. A shared address does not identify a person. This page always uses the current WordPress site.

Clear filters

Up to 500 matching observations, 100 group summaries and 100 policy-history entries. With filters, context is linked to the exported observations; group counts describe whole groups. Without filters, context includes recent site history. Each category declares its limit and whether more records exist.

Patterns over time

Groups combine admitted observations by this site, primary family, source label and UTC minute. They do not group people or exact IPs. Counts are admitted lower bounds, not all traffic; a request with several rule matches appears in one primary group. Samples may be unavailable after observation retention.

OBSERVED REQUEST PATTERNS

What is reaching WordPress?

Compare admitted findings in the retained minute groups below.

Component metadata enumeration2 observations
Configuration-resource probe pattern2 observations
Source-control or diagnostic discovery2 observations

Bar lengths are relative to the largest family in this selection. Findings are lower bounds, not visitor counts or proof of an attack.

Component metadata enumeration · 2026-10-19 19:04:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 19:04:27.000000 +00:00 / 2026-10-19 19:04:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 0 / 0 / 1 / 0
Recorded WordPress responses
0
Sample evidence IDs
["6"]
Component metadata enumeration · 2026-10-19 19:03:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 19:03:27.000000 +00:00 / 2026-10-19 19:03:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 1 / 0 / 0 / 0
Recorded WordPress responses
0
Sample evidence IDs
["5"]
Configuration-resource probe pattern · 2026-10-19 19:02:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 19:02:27.000000 +00:00 / 2026-10-19 19:02:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 0 / 0 / 1 / 0
Recorded WordPress responses
0
Sample evidence IDs
["4"]
Configuration-resource probe pattern · 2026-10-19 19:01:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 19:01:27.000000 +00:00 / 2026-10-19 19:01:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 0 / 0 / 1 / 0
Recorded WordPress responses
0
Sample evidence IDs
["3"]
Source-control or diagnostic discovery · 2026-10-19 19:00:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 19:00:27.000000 +00:00 / 2026-10-19 19:00:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 0 / 0 / 1 / 0
Recorded WordPress responses
0
Sample evidence IDs
["2"]
Source-control or diagnostic discovery · 2026-10-19 18:59:00.000000 +00:00 · at least 1 admitted · synthetic_test
First / last (selected timezone)
2026-10-19 18:59:27.000000 +00:00 / 2026-10-19 18:59:27.000000 +00:00
Source association
Unavailable; this is a site/time/family group
Partial analyses
1
Unknown final statuses
0
HTTP 1xx / 2xx / 3xx / 4xx / 5xx
0 / 0 / 0 / 1 / 0
Recorded WordPress responses
0
Sample evidence IDs
["1"]

Recent repeated-resource patterns

Current retained admitted findings only. Counts are lower bounds; missing telemetry is not quantifiable. Fixed UTC-minute boundaries can split a sequence. Site and exact-peer views overlap and must not be summed. No attacker identity, historical alert, exposure, prevention or automated-response eligibility is established.

Examined 6 of at most 500 current retained rows across five fixed one-minute windows. Row limit reached: no. Partial analyses excluded from thresholds: 0. Unknown final statuses: 0.

No qualifying pattern in this bounded retained view. This does not establish an absence of probing or missing requests.

Individual observations

Component metadata enumeration · theme_metadata_resource · Oct 19 · 19:04 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: structural_only. Intent, identity, vulnerability and exploitation are unknown.

Documentation tools and legitimate theme stylesheets can use related routes; theme style.css is excluded.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
6
Alert work
skipped
Local request reference
9d4769af-63a5-4753-8446-495e4629b376
Sensor / source
server_log / synthetic_test
Rule / revision
core.component-readme / 1
Safe resource template
theme_metadata_resource
Method
HEAD
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
404
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 19:04:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 19:04:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.component-readme · path · theme_metadata_resource · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Component metadata enumeration · plugin_metadata_resource · Oct 19 · 19:03 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: structural_only. Intent, identity, vulnerability and exploitation are unknown.

Documentation tools and legitimate theme stylesheets can use related routes; theme style.css is excluded.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
5
Alert work
skipped
Local request reference
e003c92b-bd6b-4c3a-a07a-35c96736a6b9
Sensor / source
server_log / synthetic_test
Rule / revision
core.component-readme / 1
Safe resource template
plugin_metadata_resource
Method
GET
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
200
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 19:03:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 19:03:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.component-readme · path · plugin_metadata_resource · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Configuration-resource probe pattern · /wp-config.php.bak · Oct 19 · 19:02 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: high_pattern_only. Intent, identity, vulnerability and exploitation are unknown.

An authorized scanner or broken integration can request these resources.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
4
Alert work
skipped
Local request reference
e8206df1-4cee-4d3b-90c9-ed6046ccb877
Sensor / source
server_log / synthetic_test
Rule / revision
core.reserved-configuration / 2
Safe resource template
/wp-config.php.bak
Method
GET
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
404
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 19:02:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 19:02:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.reserved-configuration · path · /wp-config.php.bak · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Configuration-resource probe pattern · /.env · Oct 19 · 19:01 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: high_pattern_only. Intent, identity, vulnerability and exploitation are unknown.

An authorized scanner or broken integration can request these resources.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
3
Alert work
skipped
Local request reference
e09f3acc-c4a2-4aaf-b7ec-54ba9e72f90d
Sensor / source
server_log / synthetic_test
Rule / revision
core.reserved-configuration / 2
Safe resource template
/.env
Method
GET
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
404
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 19:01:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 19:01:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.reserved-configuration · path · /.env · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Source-control or diagnostic discovery · /.git/HEAD · Oct 19 · 19:00 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: high_pattern_only. Intent, identity, vulnerability and exploitation are unknown.

Authorized diagnostics can deliberately request these resources.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
2
Alert work
skipped
Local request reference
999b5118-cd8a-46b3-acc5-31f1ee5a1236
Sensor / source
server_log / synthetic_test
Rule / revision
core.source-diagnostic / 1
Safe resource template
/.git/HEAD
Method
GET
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
404
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 19:00:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 19:00:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.source-diagnostic · path · /.git/HEAD · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Source-control or diagnostic discovery · /.git/config · Oct 19 · 18:59 · synthetic_test

Why it matched

Server-reported safe resource class; original target and query unavailable. Confidence: high_pattern_only. Intent, identity, vulnerability and exploitation are unknown.

Authorized diagnostics can deliberately request these resources.

Inspect captured source fields
Client-source derivation
imported_direct_peer
Client-source quality
reported_server
Evidence ID
1
Alert work
skipped
Local request reference
439bec22-b20c-4996-91da-8cc39944befa
Sensor / source
server_log / synthetic_test
Rule / revision
core.source-diagnostic / 1
Safe resource template
/.git/config
Method
GET
Client source (disabled)
unavailable
Client-context availability
privacy_disabled
Partial analysis
yes; observation only
Final HTTP status
404
Logged.ai action
No Logged.ai response
Application effect
Unknown
Captured (selected timezone)
2026-10-19 18:59:27.000000 +00:00
Ingested (selected timezone)
2026-10-19 19:05:27.000000 +00:00
Response observed (selected timezone)
2026-10-19 18:59:27.000000 +00:00

Quality flags: server_safe_class_projection, original_target_and_query_unavailable

  • core.source-diagnostic · path · /.git/config · literal

Related activity

No application effect or actor relationship has been established. Matching IP context is not identity. A 200, 403 or 404 does not establish exposure or prevention.

Available response controls

Preview requires response capability and complete eligible evidence. Ambiguous/encoded input remains observation only.

Interpretation limits

These conservative rules do not provide complete attack coverage. Repeated-resource patterns use only the bounded retained view; arbitrary missing-path sequences are unavailable. The observer self-test checks a controlled WordPress request through the configured source boundary; it does not test all routing or prove the site is secure. Typed manual policies use a separate matcher revision; existing policies keep their original conditions.