How to configure WordPress file changes log and notifications

WP Activity Log uses Melapress File Monitor to detect and log file changes in the WordPress activity log.

Melapress File Monitor is a dedicated file integrity monitor plugin for WordPress, developed by us, and is completely free.

This document explains in detail how to use both plugins to detect file changes and keep a log of them in the WordPress activity log. It also explains how to configure email and SMS notifications for when file changes occur.

Detecting website file changes and keeping a log in the activity log

If you want to detect and keep a log of website file changes in the activity log, follow these steps:

1. Navigate to WP Activity Log > Settings
2. Click the File changes tab
3. Click on Install plugin now

This will automatically download and install the Melapress File Monitor plugin on your WordPress website. Refer to this Getting Started with Melapress File Monitor guide for information on scheduling scans and configuring the basic settings.

File changes information in the activity logs

With both plugins installed, WP Activity Log keeps a record of any file changes in the activity log. It also keeps a record of when a scan starts or stops.

Click on Review Changes to see the details of the file change in the Website File Changes Monitor plugin.

Activity log event IDs for file changes

The event IDs used to keep a log of file integrity monitoring scans and file changes in the WordPress activity log are:

• 6030: Melapress File Monitor file/directory change detected
• 6031: Melapress File Monitor file skipped due to size
• 6032: Melapress File Monitor core file change detected
• 6033: Melapress File Monitor scan started/finished
• 6073: Melapress File Monitor scan frequency modified
• 6074: Melapress File Monitor scan time modified
• 6075: Melapress File Monitor WordPress core file integrity check was enabled/disabled
• 6076: Added an allowed file in the WordPress core file integrity check
• 6077: Removed an allowed file in the WordPress core file integrity check
• 6078: Melapress File Monitor settings reset to default

If you do not want to keep a log of a specific change, you can disable any of these events from the Enable/Disable Events section, in the File Changes tab. For more information on the different event IDs, refer to the list of event IDs in the WordPress activity log.

Get alerted via Email, SMS, or Slack of important site file changes

When using WP Activity Log and Melapress File Monitor, you can configure email, SMS, and Slack notifications for when there are file changes on your website. Let’s assume you want to receive an email whenever there is any type of file change. You also want to receive an SMS when existing files are modified or a Slack message whenever a scan starts or stops. Below you’ll find examples of how you can achieve this.

Get an email notification for any file change

The plugin keeps a record of file changes with event IDs 6030 and 6032. To receive an email notification when any of the above are reported:

1. Navigate to the Notifications section in the plugin menu
2. Click the Custom Notifications tab and click Create custom notification
3. Specify a title, select Send to default email address, and add the following trigger:

(EVENT ID IS EQUAL 6030) OR (EVENT ID IS EQUAL 6032)

Below is a screenshot of how this custom notification should look when configured in the plugin. The next time any of these event IDs are reported in the WordPress activity log, you will receive an email notification with all the details.

Refer to the Getting started with activity log notifications for WordPress for more details on how to set up triggers, etc.

Get an instant SMS message when core files are changed

Core files on a WordPress website only change when WordPress core is updated. So, it is a good idea to set up an SMS notification for when existing core files are changed. Better safe than sorry!

The process is very similar to email notifications; you have to create a custom notification. However, the rule is a bit different, and you’ll need to specify a phone number instead of an email address. Here is how you can do it:

1. Navigate to the Notifications section in the plugin menu
2. Click the Custom Notifications tab and click Create custom notification
3. Specify a title, select Send to default phone number, and add the following trigger:

EVENT ID IS EQUAL 6032

The next time event ID 6032 is reported in the WordPress activity log, you will receive an SMS notification.

Refer to the SMS notifications for WordPress administrators guide for more details on how to setup the SMS carrier and other SMS notifications examples.

Get a Slack notification when a scan starts or stops

Getting notified whenever a file changes scan starts or stops can help you ensure scans are being carried out.

The process for setting up a Slack notification is similar to both email and SMS notifications. In this example we will also be setting up a custom notification. However, this time around it will be for event ID 6033.

1. Navigate to the Notifications section in the plugin menu
2. Click the Custom Notifications tab and click Create custom notification
3. Specify a title, select Send to default slack channel, and add the following trigger:

EVENT ID IS EQUAL 6033

Refer to the How to integrate WP Activity Log with Slack for instant notification for more information on how to set up Slack to receive activity log notifications.