Reading your WordPress activity log: normal vs suspicious

Your WordPress activity log sounds a bit boring at first. Like something only a developer would care about. But honestly, it’s one of the few places where your website tells you what actually happened.

Who logged in. What got changed. Which plugin was activated. Whether a new user suddenly appeared at 2:14 AM for no good reason. Stuff like that.

If you run a small business site, this matters more than people think. Maybe you only have a brochure site with a contact form and five pages. Maybe you run bookings. Maybe you sell 12 handmade products a week. Doesn’t matter. If something weird happens, the activity log is often where the story starts making sense.

And no, you don’t need to stare at it every day like a hawk.

You just need to know what’s normal, what’s odd, and what’s a proper red flag.

What an activity log actually shows

An activity log is basically a record of actions taken on your WordPress site. Think of it like a timeline. It can show things such as:

• user logins and failed login attempts
• plugin and theme installs, updates, activations, and deletions
• changes to posts, pages, menus, widgets, and settings
• new user accounts and role changes
• WooCommerce order-related actions on shop sites

That’s why tools like an activity log feature are so handy — they turn random behind-the-scenes events into something you can actually read.

I’ve seen this save people a lot of time. A business owner notices their homepage title changed, swears they didn’t touch it, then checks the log and sees an old freelancer account logged in last Thursday and edited it. Mystery solved. Awkward, maybe. But solved.

What “normal” usually looks like

Normal depends on your site. A solo consultant’s website will have a very quiet log. An online store with staff, orders, coupons, and customer accounts will be noisy all day long.

Still, there are patterns that are pretty ordinary.

For most small business websites, normal activity includes occasional admin logins during work hours, plugin updates, page edits, image uploads, and maybe a few failed logins from yourself because you typed the password wrong on your phone. We’ve all done it.

If you have a marketing person, a shop manager, and maybe one developer, you’ll also see repeated actions from the same small set of users. Same usernames. Same rough times. Same kinds of changes.

That’s the key, really. Familiarity.

A normal log feels boring. Predictable. Slightly repetitive.

And that’s good.

What starts to look suspicious

Suspicious activity usually isn’t one giant flashing warning. It’s more like a weird smell in the room. Something feels off before you can fully explain why.

Here are a few things that should make you stop and look closer:

1. Login attempts at strange times If nobody on your team works at 3 AM, why is an admin account logging in then?
2. Lots of failed logins in a short burst That often means bots are hammering your login page trying common passwords.
3. A new user account appears out of nowhere Big one. Especially if the role is Administrator.
4. Plugins being installed or activated without a clear reason If you didn’t add it, who did?
5. Settings changes you didn’t approve Homepage settings, email address changes, permalinks, user roles — these aren’t random.
6. Repeated file or content edits followed by downtime or spam That’s often how hacked sites start to show themselves.

If your site has been acting oddly already, this article on Signs Your WordPress Site Has Been Hacked is a good companion read. It helps connect weird log entries to real-world symptoms.

Examples from real small business situations

Let’s make this less abstract.

Say you run a local dental clinic website. You log in a few times a month to change opening hours or upload a staff photo. Your developer updates plugins now and then. Pretty quiet site.

In that case, these log entries are probably normal:

• Admin login Monday at 9:12 AM — Plugin updates on Wednesday afternoon — Page “Contact” edited by your assistant — Theme updated once this month

But this? Not normal.

• 67 failed logins in 10 minutes — New user created: “wpservice_admin22” — Plugin installed: some SEO plugin nobody recognizes — General settings email changed at 1:48 AM

That’s not “maybe weird.” That’s investigate-now weird.

Or let’s say you run a small WooCommerce store. Your log will naturally be busier. Orders get updated. Coupons get created. Customer emails get resent. A shop assistant might edit product stock. Fine.

But even on a busy site, certain events still stick out like a sore thumb — admin role changes, plugin installs, password resets for accounts that didn’t request them, or a burst of failed logins from different IPs.

How to check if a suspicious event is actually a problem

Don’t panic the second you see something unfamiliar. Sometimes it’s harmless. A host runs an automatic update. A freelancer forgets to mention a change. You test a plugin and forget. It happens.

What you want is context.

Start with these questions:

Who did the action? When did it happen? Was it expected? Did anything break right after? Do you recognize the username, plugin, or IP?

If you can answer those quickly, great. If not, that’s where the log earns its keep.

And if you’re not already reviewing updates carefully, read How to safely update WordPress, plugins and themes. A lot of “suspicious” events turn out to be messy update habits rather than a full hack.

What to do when the log shows a real red flag

If you spot something clearly bad, move fast. Not frantic. Just fast.

Here’s a sensible order:

• change passwords for all admin accounts
• remove unknown users immediately
• update WordPress, plugins, and themes
• scan the site for malware and backdoors
• check whether files or settings were modified
• restore from a clean backup if needed

If the site is already hacked, redirecting visitors, or injecting spam pages, this is the point where DIY can get messy fast. A proper site cleaning service makes more sense than poking around and hoping for the best. I’ve seen people spend six hours deleting obvious junk while the hidden backdoor stays in place. Big mistake.

You don’t need to monitor everything manually

This part matters because small business owners are busy. You’re not sitting around refreshing logs between customer calls.

You want enough visibility to catch problems early, without turning website management into a part-time job. That’s why ongoing WordPress maintenance usually works better than the “set it and forget it” approach. Sites change. Plugins age. User accounts pile up. Somebody always says they’ll clean it up later.

Later has a habit of not showing up.

A decent maintenance setup should include update checks, backups, security monitoring, and some way to review changes over time. If nobody’s watching, weird activity can sit there for weeks before anybody notices.

The biggest mistake: ignoring small oddities

The worst activity log entries aren’t always dramatic. Sometimes it’s a tiny thing that gets brushed off.

A failed login burst. One unknown user. A plugin activation nobody remembers. A settings tweak “probably from the host.” Then two weeks later the site starts sending spam or showing Japanese pages in Google results. And now you’re in a hole.

So yes, pay attention to the little stuff. Not obsessively. Just enough to notice patterns breaking.

That’s really what you’re doing here — learning your site’s normal behavior so the abnormal stuff feels obvious.

Once you get used to reading the log, it stops looking technical. It starts looking like evidence. Helpful evidence. And for a small business website, that’s often the difference between catching a problem early and finding out from a customer who says, “Hey, why is your site sending me to a casino?”

Originally published at https://bearmor.eu.