About this plugin
An AI agent, a headless front end, a sync script and a cron job all reach WordPress the same way a person never does: over an API. When something on the site is not what you left it as, the question is not “who changed this” but “did a person change this, or did something else”. This plugin answers that question and only that question. It records changes that arrived over the REST API, WP-Cron, WP-CLI or XML-RPC. A change made by a person clicking in wp-admin is not recorded – not filtered out afterwards, not stored and hidden, simply never written. Why not a general activity log General activity logs record everything, which means the automated change you are looking for is one line in a thousand made by your own team. This one starts from the other end. If you already run an activity log, this sits beside it and answers a different question. What it records The channel – rest , cron , cli or xmlrpc . Which application password authenticated the request, by name, when there was one. Never a guess: when the name cannot be determined the field is empty rather than filled with a User-Agent or an IP that merely looks like an identity. What changed – the object, and which fields were touched. When , in UTC, shown in your site’s timezone. What it does not record Not the values. The names of the fields that changed, never their contents. A log of what your site contains is a second copy of your site. Not people. A block editor save is a cookie-authenticated REST request, and it is recognised as a person and skipped. This is the plugin’s central promise, and it is the case it was hardest to get right. Not reads. Something polling the REST API would fill the table in a day and drown the writes that were the reason to look. No IP addresses. Reading the log On its own admin screen, filtered by channel, object type and date range. Or over the REST API at digitizer-ai-agent-log/v1/activity , which requires manage_options . There is deliberately no route that deletes: a log that can be erased through the API is a log an attacker erases on the way out. Multisite Each site keeps its own log, in its own table, and a run that switches between sites files each change under the site it happened on.