SML Sentinel

SML Sentinel is an activity log from Scarlett Media Lab. It does not only watch what users click. It records the lifetime of an area of a WordPress site — sign-ins, content, plugins, files, errors, and housekeeping — in one place, written so both non-technical site owners and developers can use it.

You get four screens: Overview, Activity Logs, Event Registry, and Settings. Administrators also get a first-run Quick Setup wizard. Editors who can edit published posts can open Overview and Activity Logs; Event Registry and Settings stay with administrators.

What it records

Built-in events cover:

• Sign-ins, sign-outs, failed sign-ins, new accounts, role changes, and profile updates

• Posts and pages published, updated, or deleted; comments posted, approved, or deleted

• Files added to or removed from the Media Library

• Plugin, theme, and WordPress core changes

• PHP and WordPress errors, including fatal errors, database errors, and memory pressure

• Sentinel’s own housekeeping (cleanup, anonymisation, deletion requests)

If WooCommerce, Contact Form 7, WPForms, or Yoast SEO is active, Sentinel records a small set of those plugin’s events as well (order and payment changes, form submissions without message text, SEO updates). Gravity Forms is not recorded.

You can pause individual event types in Event Registry. You can also skip everyday actions from chosen user roles; critical system errors and role changes are still stored. A new install records every role, including administrators.

A site that has already chosen to hide a role keeps that choice.

This is a log, not a firewall. It does not block brute-force logins or scan for malware.

Admin screens

• Overview — today’s counts, a week of volume, a heatmap, site health, and recent activity

• Activity Logs — searchable history with filters and a detail drawer

• Event Registry — the catalogue of what Sentinel can detect, grouped (sign-ins, security, content, plugins and themes, errors, privacy, system, plus integration groups when those plugins are present)

• Settings — data and retention, privacy and access, notifications, performance, export and API, maintenance

Email

Mail uses WordPress’s mailer. If the site cannot send email, these switches will not fix delivery.

• Urgent alerts — one email when a critical event happens (PHP fatal, database or configuration error, critical memory use, a watched file change, or Sentinel’s own logging rate limit being exceeded). The same type stays quiet until the next day.

• Daily summary — one morning briefing: failed sign-ins (counted, not emailed one by one), what changed, and errors

• Weekly summary — optional; same briefing template rolled up for the week. Off unless you turn it on.

There is no per-event email filter maze.

Retention, privacy, and export

• Live rows can be archived by age and by a maximum live count. Archived rows can be kept or deleted on a schedule.

• Optional IP logging on new events. Optional anonymisation of older records (IPv4 and some email or username fields in payloads). IPv6 is not masked today. Anonymisation cannot be undone.

• Optional deletion-request form via the [sentinel_data_deletion_request] shortcode. Logged-in users can ask; an administrator still has to approve. This does not delete the WordPress account. There is no per-user export of Sentinel data; administrators can download activity from Settings → Export & API (CSV, JSON, or XML).

• Optional read-only REST access ( sentinel-plugin/v1 ) behind an API key you generate in Settings.

Files and performance

htaccess. That is a scheduled hash check, not live file watching.

Optional batch writes, a cap on how many events are stored per minute or hour (this protects the database; it is not login protection), and optional memory-pressure handling. Most sites can leave these as they are.

Bundled libraries

• Chart.js 4.5.1 (MIT) is included locally at admin/js/vendor/chart.min.js. Upstream source: https://github.com/chartjs/Chart.js

• Inter and Poppins (SIL Open Font License) are included at admin/fonts/. See admin/fonts/OFL.txt.

Developer

SML Sentinel exposes a small companion API. Free stays complete without a companion.

• Constant SENTINEL_API = 1

• Action sentinel_loaded

• Filter sentinel_monitored_files

• Filter sentinel_extra_event_definitions and action sentinel_register_extra_events

• Filter sentinel_can_register_event

• Action sentinel_event_logged ( $event_key, full redacted $record, $log_id )

• Filter sentinel_settings_extra and sentinel_log_management_pre_update so companion settings persist

• Admin: sentinel_admin_menu, sentinel_admin_screen_hooks, sentinel_overview_widgets, sentinel_settings_tabs, sentinel_settings_sections

Use sentinel_log_event() to write. Secrets in payloads, URLs, and user agents (cookies, HMACs, tokens, passwords, API keys) are stripped before storage.