See all monitors →
Security & integrity

A WordPress activity log an intruder can't erase.

Relvato keeps a log of what happens on your WordPress site, who did it and from which network, outside your site, and alerts you when an admin signs in from somewhere new.

Supported sitesWordPress plugin
WordPresssupportedWooCommercesupportedOther stacksnot supported
This monitor reads data from inside WordPress, so it needs the free Relvato plugin.
What it checks
  • ✓Administrator and editor sign-ins, with the network they came from
  • ✓An admin signing in from a network none of your admins used in 90 days
  • ✓Failed sign-ins counted per 10 minutes, and spikes against real usernames
  • ✓Plugin, theme and WordPress updates, activations and theme switches
  • ✓Role changes, deleted admins, application passwords, key settings and code-editor saves
  • ✓Kept from 7 days to a year, by plan; never the address, only the network
Why it matters

An activity log stored in the WordPress database is the first thing an intruder with admin access can empty. Activity-log plugins also put the alerts and the search behind a paywall, and the log grows inside the site it's supposed to watch. Relvato keeps the record somewhere the site can't reach and reads it for you.

How it works
  • The plugin reports what happens as it happens: admin and editor sign-ins, failed sign-ins, updates, role changes, key settings, code edits and application passwords.
  • Relvato keeps the log on its own servers, not in your WordPress database, and shows it on the site's Activity tab.
  • The admin-logins monitor alerts you when an admin signs in from a network none of your admins used in 90 days, or when failed sign-ins spike.
Questions, answered
Why keep the log outside WordPress?

Anyone with admin access can empty a log that lives in the site's own database, and that's exactly who you need the log for. Relvato receives each entry as it happens and keeps it on its own servers.

What do you store about people?

The WordPress username, its role, and the network a sign-in came from (the address cut down to a /24 or /48 range, never the full address). Failed sign-ins are counted; the usernames tried are never sent.

Does it need the plugin?

Yes. The events happen inside WordPress, so the Relvato plugin (1.41.0 or later) reports them.

Related monitors
Activity log & admin logins

Put this monitor on autopilot.

Free forever on one site — every monitor, 100 runs a month. No card, no sales call.