--- title: "The Security-Driven Activity Log: Attack Detection for Your WordPress Sites" description: "Learn how WP Umbrella watches what happens on your WordPress sites, deduces attack patterns from the raw activity, and gives you the evidence behind every alert. The Security-Driven Activity Log is part of the Security add-on, alongside the Firewall & Virtual Patching and Security Hardening." url: https://support.wp-umbrella.com/en/articles/93-the-security-driven-activity-log-attack-detection-for-your-wordpress-sites collection: "Monitoring & Security" updated: 2026-11-01 language: en --- # The Security-Driven Activity Log: Attack Detection for Your WordPress Sites Learn how WP Umbrella watches what happens on your WordPress sites, deduces attack patterns from the raw activity, and gives you the evidence behind every alert. The Security-Driven Activity Log is part of the Security add-on, alongside the Firewall & Virtual Patching and Security Hardening. ## The Security-Driven Activity Log: Attack Detection for Your WordPress Sites WP Umbrella has always included an **Activity Log for platform operations**: who on your team updated a plugin, when a backup ran, what changed inside WP Umbrella. That log stays included on every account. The **Security-Driven Activity Log** is different. It records what happens **on the WordPress sites themselves** (sign-ins, content changes, account changes, file edits) and **analyzes those events for security patterns**. A single failed login means nothing. Dozens of failed logins spread across many IPs in a day is a slow brute-force built to stay under rate limits. This log makes that distinction for you. 🛠 **Prerequisites:** - WP Umbrella plugin installed and activated on your WordPress site - Active Security add-on (+2€/month per site) ## What It Detects ![](https://staticfiles.gleap.io/ghelparticle/Acciee27zBDiwF59ssXGPUFmWIU5kcukKuJaReNWfEWve8ddwlHVvsnSO0vYImAakPJrMQaAqof.png) Open the **Security tab** of a site and go to the **Activity Log** section. Detections appear under **Needs attention**; verified-quiet checks appear under **All clear**.

Detection	What it watches for	Why it matters
Brute-force protection	Repeated failed sign-ins on an account, including attempts spread across many IPs	Password attacks rarely come from one address; distributed attempts are designed to evade simple rate limits
Mass content deletion	An unusual volume of posts or media deleted within minutes	A common signature of a compromised account or a destructive script
Privilege escalation	The first time an account is granted administrator access	Usually a legitimate change, but a new admin is also how attackers keep access; worth a quick confirmation
Unusual sign-in location	A login from a location never seen for that account	We learn the IP patterns each user normally signs in from; a deviation is a possible sign of stolen credentials
File integrity	Direct edits to WordPress core or theme files	Legitimate updates rarely touch these files this way; it's a frequent hiding place for injected malware
Critical settings changed	Changes to the handful of settings attackers target first	Changing the site address can hijack traffic, swapping the admin email can lock you out, and open registration with a default administrator role leaves a quiet backdoor

## Every Alert Comes with Evidence An alert you can't verify is just noise with a severity label. Click **View details** on any detection to see an exact breakdown of what happened. ![](https://staticfiles.gleap.io/ghelparticle/6pLxC7b5SIlst78nz3zYgpuLUXOhyNn1zz2NfXbAtVuc1QifhKzUae2fKQxSTua1GaL3dcwfs5A.png) This is the "what happened, who did it, when" answer you need after an incident, whether you're fixing the site or explaining the situation to a client. ## The All-Clear Matters Too Checks that pass are listed explicitly under **All clear**. A dashboard that only shows problems can't tell you the difference between "safe" and "unmonitored". Here, a quiet log means verified quiet. ## Browsing the Raw Activity ![](https://staticfiles.gleap.io/gattachments/nFZS3dZxL2RSjHBX18lmloNGx7hwjdbu63qHNcL2ftmmFBMaEiC3ksJohNOs54H2bKRmuhFvEFr.png) Below the detections, the **Recent activity** feed records the underlying events, with: - A chart of events recorded over time - Search across events - Filters by **period**, **severity**, **component**, and **user** Useful for audits, client questions, and the occasional "who changed that?" mystery. ## Dismissing a Detection Pattern detection uses thresholds, and thresholds occasionally flag legitimate work; a client bulk-deleting old content can look like mass deletion. When you've verified a detection is expected, dismiss it from the list. We'd rather you dismiss one explainable alert than miss a real incident. ## Frequently Asked Questions ### **❓**Is this enabled automatically? Yes. Enabling the Security add-on on a site turns the Security-Driven Activity Log on, along with the firewall and the recommended hardening defaults. You can toggle it per site. ### **❓**I was already on Site Protect. Do I pay extra for this? No. Site Protect became the Security add-on at the same price, and the new features are included. If the add-on was already active on a site, visit its Security tab to make sure the Activity Log is switched on. ### **❓**Does it slow down my site? No. Event recording is lightweight and the pattern analysis happens on WP Umbrella's infrastructure, not on your server. ### **❓**How is this different from an activity log plugin? Standalone log plugins record events; reading and interpreting them stays your job. This log does the analysis: it correlates events across time, accounts, and IP addresses, and only asks for your attention when a pattern matches a known attack shape. And it lives in the same dashboard as your updates, backups, and monitoring, instead of inside each site's wp-admin. ### **❓**What happens if I disable the Security add-on? Security detections stop. The platform-operations Activity Log (what happens inside WP Umbrella) continues, since it's included on every account.