Audit Log — admin activity log for WooCommerce

Audit Log for WooCommerce keeps its own log: as soon as more than one person works in the store, questions come up — who changed the price, who cancelled the order, when the discount disappeared. WooCommerce doesn’t answer these: the order screen only shows status changes, and nothing else is recorded anywhere.

What gets logged

Every action becomes a separate entry: user, role, IP, time and a list of changed fields shown as “before → after”. Orders (status, totals, payment method, addresses, line items, deletion), products (price, sale price, stock, availability, SKU, status, dimensions, descriptions), categories, tags and attributes, WooCommerce settings compared key by key, users and roles, plugins and themes, plus logins, logouts and failed login attempts.

A log you can’t fake

Entries can’t be edited from the interface — there is no button and no request to edit or delete a single row. Only clearing by retention rules and a full wipe are available, and both of those are logged too.

Privacy by default

Passwords, tokens, API keys, card numbers and similar fields are masked before being recorded — they’re absent from the screen, the CSV export and the database dump alike. A password change is recorded as a fact, with no value and no hash. IP is taken only from REMOTE_ADDR, and storing the user agent can be switched off.

Size under control

Retention rules work by age and by row count (in Free, 90 days and 50,000 entries), and each event group can be switched off. In Pro, retention goes up to 10 years with no row limit.

Why a store needs this

Once more than one person has admin access, sooner or later the question “who changed the price” or “where did the product go” comes up. Without a log there’s no answer — only guesswork and a strained team.

An activity log settles this with facts: who, when, exactly what changed, and from what value to what.

How it works, step by step

1. The module switches on and starts recording admin users’ actions.

2. Each entry is a user, a time, an object, and a “before → after” change.

3. The log can be filtered by user, action type and period.

4. Old entries are cleared after a set retention period — with a button, or daily and automatically in Pro — so the table doesn’t grow forever.

Under the hood

The log lives in its own table and doesn’t bloat wp_options. Recording happens synchronously with the action, so there are no “gaps” in the log from a failed cron run.

The module doesn’t log what it has no right to keep: passwords, tokens, API keys and card numbers are masked before the entry is written. Addresses and other order data do get logged — as part of the before → after changes.

How to install

1. Upload the archive via “Plugins → Add New → Upload Plugin” and activate it.

2. Set the retention period for entries.

3. Change something on a test product and check that an entry appeared.