Documentation

Documentation

"Knowledge is the foundation of vigilance." Sentinel Archives

Everything you need to deploy and configure Sentinel.

Installation

Since v1.2.0

Sentinel 1.2 records what happens on a WordPress site and shows it in admin.

A log, not a firewall

Sentinel does not block sign-ins or scan for malware. It writes an activity record you can read, filter, and export.

Requirements

1

WordPress

5.3 or higher (tested up to 7.1)

2

PHP

7.4 or higher

3

MySQL

5.6 or higher

4

Memory

64MB PHP memory is enough for most sites

From WordPress.org

1

Open the listing

Go to wordpress.org/plugins/sml-sentinel, or in wp-admin use Plugins → Add New and search for Sentinel by Scarlett Media Lab.

WordPress.org listing
2

Install and activate

Install the plugin, then activate it. Administrators see Quick Setup on first run.

No licence field

Sentinel 1.2 does not ask for a licence key.

From a zip

Use this if the site cannot use the plugin directory. Keep the same version as WordPress.org.

1

Download the zip

Get it from getsentinel.dev/download.

Download page
2

Upload and activate

In wp-admin go to Plugins → Add New → Upload Plugin, choose the zip, then activate.

Sentinel+ is a separate plugin

A Sentinel+ licence does not work in Sentinel 1.2. If the site already runs Plus, keep that plugin. Do not replace it with the Free 1.2 zip unless you mean to drop Plus features.

Quick Setup

Since v1.2.0

Administrators see Quick Setup the first time Sentinel 1.2 runs. You can open it again from Settings.

No licence step

The wizard does not ask for a key. Skipping it does not turn Sentinel off.

What it sets

1

Monitoring

How much everyday activity to record. Pause individual types later in Event Registry.

2

Privacy

Whether new events store IP addresses, and related defaults. Change these under Settings → Privacy & access.

3

Preview

Check the summary, apply the presets, or skip and keep the defaults.

Overview

Since v1.2.0

Overview is the first screen in the Sentinel menu. It summarises what has already been recorded.

Today

Counts for the current day.

Volume

A week of activity, as a chart.

Heatmap

When events clustered over the week.

Site health

Whether file watch, mail, and related checks are on.

Recent activity

A short list of the latest events.

Not a live feed

Open Activity Logs for the full history. Editors who can edit published posts can open Overview. Event Registry and Settings stay with administrators.

Activity Logs

Since v1.2.0

Activity Logs is the history of events Sentinel has stored. Open a row for the detail drawer.

Filters

1

Event type

The catalogue key, such as a sign-in or a plugin update.

2

User

Including guest rows where there is no account.

3

Priority

Critical, high, medium, or low.

4

Date

From and to.

5

IP

Only if IP logging is on in Settings.

Older names

Docs that say Dashboard or Activity Log (singular) mean this screen. It is an audit trail, not a live stream.

First Steps

Since v1.2.0

After install, the Sentinel menu has four items.

1

Overview

Counts, volume, heatmap, and recent activity.

2

Activity Logs

Search and inspect what has already happened.

3

Event Registry

What Sentinel can detect. Pause types you do not want. WooCommerce, Contact Form 7, and WPForms add groups when those plugins are active. You cannot add custom events in Sentinel 1.2.

4

Settings

Data and retention, privacy and access, notifications, performance, export and API, and maintenance.

Email

Mail uses WordPress

If the site cannot send email, these switches will not fix that.

1

Urgent

Critical events only. The same type stays quiet until the next day.

2

Daily briefing

Failed sign-ins are counted here, not emailed one by one.

3

Weekly briefing

Off unless you turn it on.

What counts as critical

PHP fatal, database or configuration error, critical memory use, a watched file change, or Sentinel hitting its own logging rate limit.

Sentinel+ activation

Since v1.1.0Sentinel+

Sentinel+ is its own plugin (£9/month). Do not run it alongside the free Sentinel plugin. Remove Free, install Plus, then activate the licence.

One plugin per site

If the free plugin is still installed, deactivate it and delete it before you install Sentinel+.

1

Buy Plus

Subscribe on the Sentinel+ page. Stripe sends a licence key to the purchase email.

Sentinel+
2

Remove the free plugin

Plugins → Installed Plugins. Deactivate Sentinel (free) and delete it.

3

Install Sentinel+

Upload the Sentinel+ zip from your purchase and activate it.

4

Enter the licence

Paste the key in Sentinel+. Current keys look like SEN-XXXX-XXXX-XXXX-XXXX.

Purchase Process

Since v1.1.0Sentinel+
1

Open Sentinel+

Go to getsentinel.dev/plus. Plus is £9/month, billed through Stripe, one site per licence.

Buy Sentinel+
2

Pay

Complete checkout. The confirmation email includes the licence key and the plugin zip.

3

Switch to the Plus plugin

Remove the free Sentinel plugin if it is installed, then install Sentinel+ and enter the key.

License Activation

Since v1.1.0Sentinel+
Sentinel+ must be the plugin that is installed

If you still see the free plugin, remove it and install Sentinel+ first.

1

Open Sentinel+

In wp-admin, open Sentinel+.

2

Paste the key

Format on the current build is SEN-XXXX-XXXX-XXXX-XXXX. No extra spaces.

3

Lost key

Use licence recovery with the purchase email.

Licence recovery

Verification

Since v1.1.0Sentinel+
1

Only Sentinel+ is installed

The free plugin is not in Plugins → Installed Plugins.

2

Licence is active

Sentinel+ reports the key as active.

3

Plus screens are there

Custom Events, incidents, and the other Plus tools are in the Sentinel+ admin.

Troubleshooting

Since v1.1.0Sentinel+

Plus activation

Key rejected

Issue: The licence is invalid or does not save.

Solution:

Check the SEN-XXXX-XXXX-XXXX-XXXX format and extra spaces. Retrieve it from licence recovery. Paste it in Sentinel+.

No licence field

Issue: There is nowhere to type a key.

Solution:

The free plugin is still installed. Deactivate and delete it, then install the Sentinel+ zip from your purchase.

Plus screens missing

Issue: Custom Events, allowlist, or incidents are not in admin.

Solution:

Confirm only Sentinel+ is installed and the licence is active there. Do not run both plugins on the same site.

Authentication Tracking (Sentinel+)

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+

Sentinel+ counts authentication attempts per IP and uses that for incident detection and the observe / throttle / block modes.

Email notifications

Since v1.2.0

Sentinel 1.2 sends three kinds of mail. Turn them on under Settings → Notifications.

Urgent alerts

One email when a critical event happens. The same type stays quiet until the next day.

1

PHP fatal

The site hit a fatal error.

2

Database or configuration error

WordPress could not talk to the database, or wp-config.php is broken.

3

Critical memory use

PHP is close to the memory limit.

4

Watched file change

The daily check of wp-config.php or .htaccess saw a new hash.

5

Logging rate limit

Sentinel stopped writing events because it hit its own cap. This is not login protection.

Daily briefing

1

Failed sign-ins

Counted here. They are not emailed one by one.

2

What changed

Plugins, themes, content, and similar activity from the last day.

3

Errors

Problems that were recorded but are not urgent mail.

Weekly briefing

Off unless you turn it on

Same briefing template as the daily mail, rolled up for the week. Enable it under Settings → Notifications.

Turn it on

1

Open Notifications

Go to Sentinel → Settings → Notifications.

2

Choose what to send

Urgent alerts, the daily briefing, and the weekly briefing are separate switches.

3

Save

Mail uses WordPress’s mailer. If the site cannot send email, these switches will not fix delivery.

IP Allowlist Management

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+

Listed IPs are treated as trusted so incident response does not fire on them. Administrators may also get a short automatic trust window. Configure this in Sentinel+.

Settings

Since v1.2.0

Open Sentinel → Settings. Administrators only. There is no Log Management tab in 1.2. Quick Setup can be reopened from the header on this screen.

Tabs

1

Data & retention

Live activity age and row cap, archive lifetime, and which roles are skipped for everyday actions. Critical errors are still recorded.

2

Privacy & access

IP storage, anonymise older rows, editor visibility, deletion-request shortcode, and the daily file watch.

3

Notifications

Urgent alerts, daily briefing, optional weekly briefing. See Email notifications.

4

Performance

Batch writes, event-store rate limit, PHP memory watch, scheduled OPTIMIZE of Sentinel tables.

5

Export & API

Download live or archive activity as CSV, JSON, or XML. Optional read-only REST key.

6

Maintenance

Table status, run OPTIMIZE or the write queue now, archive all live rows, or anonymise all stored records immediately.

Data & retention

1

Live activity

When auto-archive is on, rows older than the chosen number of days, or over the live row cap, move to the archive on the cleanup schedule (hourly, daily, or weekly). That does not run the moment you save.

2

Archive

Archived rows are deleted after the archive period (forever, 6 months, 1 year, 2 years, or a custom number of days). Deleted archive rows cannot be restored.

3

Roles

Do not record activity for selected roles. Everyday actions by those people are skipped. Critical system errors are still written.

Event Registry

Since v1.2.0

Event Registry is the catalogue of keys Sentinel 1.2 can write. Pause a type there and new rows of that key stop. Existing log rows are kept. Administrators only.

For developers

Log with sentinel_log_event( $event_key, $data = array(), $user_id = null ). $event_key must already be in this catalogue (or an active integration). Unknown keys are ignored. Payload is stored as JSON on the log row.

Built-in events

These keys ship with Sentinel 1.2. Labels in admin may differ slightly; the code is stable.

Sign-in

7 keys
user_login Successful WordPress sign-in.
user_logout Sign-out.
user_registered New WordPress account created.
login_failed Username or password rejected on wp-login.
auth_cookie_bad Stored sign-in cookie rejected.
auth_success Application password or other API credential accepted. Signed-in admin REST is omitted.
auth_fail Authentication attempt rejected (API/XML-RPC and similar).

Content

9 keys
profile_updated User profile updated.
post_published Post or page published.
post_updated Post or page updated.
post_deleted Post or page deleted.
media_uploaded File added to the Media Library.
media_deleted File removed from the Media Library.
comment_posted Comment posted.
comment_approved Comment approved.
comment_deleted Comment deleted.

Plugins, themes, and core

8 keys
plugin_activated Plugin switched on.
plugin_deactivated Plugin switched off.
plugin_updated Plugin updated.
plugin_events_cleaned Stored events for a plugin were cleaned up.
plugin_activation_error Plugin failed while being switched on.
theme_switched Active theme changed.
theme_updated Theme updated.
core_upgraded WordPress core upgraded.

Errors

15 keys
php_fatal_error PHP fatal. Urgent mail.
php_warning PHP warning.
php_notice PHP notice.
php_deprecated Deprecated PHP feature used.
wp_database_error Database error. Urgent mail.
wp_memory_error PHP memory limit exceeded. Urgent mail.
wp_config_error Configuration error. Urgent mail.
http_404_error Request for a missing page.
wp_remote_error Outbound HTTP request from WordPress failed.
wp_cron_error Scheduled task failed.
file_upload_error File upload failed.
wp_error WordPress error. Ordinary REST 404s and sign-in form messages are omitted.
memory_early_warning Memory use hit the early-warning threshold.
memory_warning Memory use hit the warning threshold.
memory_critical Memory use hit the critical threshold. Urgent mail.

Files and limits

4 keys
file_modified Daily hash of wp-config.php or .htaccess changed. Urgent mail. Only if file watch is on.
rate_limit_warning This IP is approaching Sentinel’s logging cap.
rate_limit_exceeded This IP hit Sentinel’s logging cap. Urgent mail. Caps log writes, not visitor logins.
api_key_generated A Sentinel REST API key was generated or regenerated.

Privacy

3 keys
user_deletion_request Logged-in user submitted [sentinel_data_deletion_request].
user_data_anonymized Personal data on log rows was anonymised.
admin_deletion_request_processed An administrator processed a deletion request.

System

8 keys
option_updated A WordPress option changed.
maintenance_mode_enabled Site entered maintenance mode.
maintenance_mode_disabled Site left maintenance mode.
logs_cleaned Old activity rows were cleaned up.
tables_optimized Sentinel tables were optimized.
log_accessed Someone opened Activity Logs (if that setting is on).
admin_test Test event written from Sentinel.
memory_auto_optimization Sentinel ran an automatic memory clean-up.

Integrations

When WooCommerce, Contact Form 7, or WPForms is active, those keys are added to Event Registry automatically. See Plugin integrations. Pause them the same way as built-in types.

Performance

Since v1.2.0

Settings → Performance. Most sites can leave these as they are.

1

Queue writes in batches

Activity can appear a little later. Use this if logging is slowing the site down. Batch size and queue interval (seconds) show when the switch is on.

2

Limit how many events are stored per minute

Protects the database if something logs in a tight loop. Critical events still get through. This is not login protection.

3

When the limit is reached

Allow some through, stop until the window resets, or keep important events only. Separate per-minute and per-hour caps.

4

Watch PHP memory use

Can skip logging when memory is under pressure. Warn-at percentage is the PHP memory limit, not a leak detector.

5

Optimise Sentinel tables on a schedule

Runs MySQL OPTIMIZE on the live and archive tables. Daily, weekly, or monthly. Housekeeping, not a speed control.

Run now

Settings → Maintenance can OPTIMIZE immediately, process the write queue, or retry failed writes.

Memory Leak Detection (Sentinel+)

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+

Sentinel+ watches memory across requests and can record leak warnings.

Privacy & access

Since v1.2.0

Settings → Privacy & access. These are tools for how Sentinel stores and shows activity. They are not a legal certification.

Identifying data

1

Store originating IP addresses

New events only. Existing rows are not rewritten. Off means future Activity and exports have no IP.

2

Anonymise older records

A daily job masks IPv4 addresses and some email or username fields in stored payloads. This cannot be undone.

3

Anonymise records older than

30, 60, 90 days, 6 months, or 1 year. Applies to live and archive. IPv6 addresses are not masked today.

Who can see activity

1

Limit what editors can see

Editors then see user, content, and authentication events only. Administrators still see everything.

2

Log when someone opens Activity Logs

Writes log_accessed, including the request query. Can get noisy on a busy site.

Also on this tab

1

Deletion-request shortcode

Enable [sentinel_data_deletion_request], then place it on a page. Details on Data Deletion Request.

2

Watch critical files daily

Hashes wp-config.php and .htaccess once a day. Details under File Monitoring.

Security Controls

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+
1

Observe

Record incidents without changing how the site answers requests.

2

Throttle

Slow repeated abuse from an IP that Sentinel+ has already counted.

3

Block

Refuse that IP while the incident is active. Pair with the allowlist so trusted addresses are skipped.

Data Deletion Request

Since v1.2.0

A logged-in person can ask Sentinel to anonymise their activity rows. An administrator has to approve. This does not delete the WordPress user, their posts, or their comments. There is no per-user export of Sentinel data; administrators download from Settings → Export & API.

What approve does

Approve masks IPv4 on that user’s live and archive rows, and some email or username fields in payloads. IPv6 is not masked. Rows stay in the log. The WordPress account is left alone.

1

Turn the shortcode on

Settings → Privacy & access → Enable the deletion-request shortcode.

2

Put it on a page

Add [sentinel_data_deletion_request] to a page. Guests are told to sign in. A second request is blocked while one is still pending.

3

Approve or deny

The request is a user_deletion_request row. Open it in Activity Logs and approve or deny. Approve writes user_data_anonymized and admin_deletion_request_processed.

File Monitoring

Since v1.2.0

When file watch is on, Sentinel 1.2 hashes two files once a day. A recorded change writes file_modified and can send urgent mail.

Where to turn it on

Settings → Privacy & access → Watch critical files daily.

What it watches

Files

2 paths
wp-config.php WordPress configuration, at the site root.
.htaccess Server rules, at the site root. Skipped if the file is missing.

Event

Log row

1 key
file_modified Daily hash no longer matches the stored baseline. Urgent mail. See Event Registry.

How File Monitoring Works

Since v1.2.0
1

Baseline

On the first successful read, Sentinel stores MD5, size, and mtime in the sentinel_file_hashes option. That first pass does not write file_modified.

2

Daily check

WP-Cron hook sentinel_check_files runs daily. Each path is ABSPATH plus the filename. Unreadable or missing files are skipped.

3

Compare

A new MD5 is compared to the stored hash. If it differs, Sentinel measures the absolute size delta against a 10-byte threshold (file_size_threshold, not shown in Settings).

4

Log or absorb

If the size delta is at least 10 bytes, it writes file_modified and then updates the stored hash. Smaller size deltas still update the baseline, so a same-size edit may not produce a log row.

Setup & Configuration

Since v1.2.0
1

Open Privacy & access

Sentinel → Settings → Privacy & access.

2

Turn on the daily watch

Enable Watch critical files daily. The help text lists wp-config.php and .htaccess.

3

Save

Cron is scheduled on the next request that loads Sentinel. There is no hourly or weekly interval in 1.2.

Monitored Files

Since v1.2.0

Hard-coded in Sentinel_File_Monitor. There is no custom path list in 1.2.

Paths

2
wp-config.php ABSPATH + wp-config.php. Type config_file. Treated as critical for messaging.
.htaccess ABSPATH + .htaccess. Type server_config. Ignored if the file does not exist.

Understanding Alerts

Since v1.2.0

file_modified is a critical event, so it can send urgent mail. The log row payload includes:

Payload

fields
file_name wp-config.php or .htaccess.
file_path Absolute path.
file_type config_file or server_config.
old_hash / new_hash MD5 before and after.
old_size / new_size / size_change Bytes. size_change_text is a signed string such as +156 bytes.
change_summary Minor / moderate / significant additions or deletions, or same-size wording (same-size usually never logs; see How it works).
last_known_modified / current_modified Unix mtimes, formatted GMT.

Best Practices

Since v1.2.0
1

Expect delay

The check is daily, not on save. A change can sit until the next cron run.

2

Deploys

Editing wp-config.php or .htaccess on purpose will look the same as an unexpected edit.

3

Urgent mail

The same file type stays quiet until the next day after one critical mail.

Troubleshooting

Since v1.2.0

File watch

No .htaccess row

Issue: nginx and some hosts never create .htaccess.

Solution:

That path is skipped when the file is missing. wp-config.php is still checked.

Change with no log row

Issue: Hash changed but size moved by fewer than 10 bytes, or cron has not run.

Solution:

Same-size content edits update the stored hash without file_modified. Wait for the daily job, or confirm WP-Cron is running.

Watch looks on but nothing happens

Issue: The switch is in Privacy & access, not a separate Files tab.

Solution:

Settings → Privacy & access → Watch critical files daily. Then wait for sentinel_check_files.

Enhanced Diff Viewer (Sentinel+)

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+

Sentinel+ stores file content snapshots and can show added and removed lines on a file-change row. Open the change from Activity Logs.

Hooks & Filters

Since v1.2.0

Sentinel 1.2 fires these hooks. Use them from a theme or a small plugin.

Actions

1

sentinel_event_logged

After a row is written. Arguments: $event_key, $event_data, $user_id.

2

sentinel_event_registered

When a key is added to the in-memory catalogue. Arguments: $event_key, $config.

functions.php 
add_action( 'sentinel_event_logged', function( $event_key, $event_data, $user_id ) {
    if ( 'plugin_activated' === $event_key ) {
        // Your own follow-up. Do not call sentinel_log_event() from here in a loop.
    }
}, 10, 3 );

Filters

1

sentinel_wp_error_is_noise

Return true to treat a WordPress error as noise so it is not stored. Arguments: $noise, $code, $message, $data.

2

sentinel_wp_error_collapse_seconds

How long to collapse repeat WP errors of the same code. Default 15 minutes. Arguments: $seconds, $code, $message.

Functions

Since v1.2.0

sentinel_log_event( $event_key, $data = array(), $user_id = null ) writes a row. $event_key must already be in Event Registry (or an active integration). Unknown keys are ignored. Payload is stored as JSON on the row.

Log a known key 
sentinel_log_event(
    'comment_posted',
    array(
        'source' => 'my-plugin',
    )
);

Summary counts

Safe for a template or widget. Counts only: no names, IPs, or log lines.

Public stats 
$stats = sentinel_get_public_stats();
// $stats['total_logs']
// $stats['today_logs']
// $stats['logins_today']

echo sentinel_get_total_logs();
echo sentinel_get_today_logs();
echo sentinel_get_logins_today();

Classes

Most integrations use the functions above. These classes are here if you need lower-level access.

Sentinel_Logger

Handles writing events to the database, including batch queueing and disabled-event checks.

class-sentinel-logger.php 
$logger = new Sentinel_Logger();

sentinel_log_event( 'my_event', array( 'detail' => 'value' ) );

$logger->log( 'my_event', array( 'detail' => 'value' ), $user_id );

REST API

Since v1.2.0

Namespace sentinel-plugin/v1. Off by default. Settings → Export & API → Allow read-only REST access, then generate a key. Anyone with the key can read activity. Keep it in server-side code.

Auth

Header (preferred) 
curl -H 'X-Sentinel-API-Key: YOUR_KEY' \
  'https://example.com/wp-json/sentinel-plugin/v1/logs'
Query parameter 
curl 'https://example.com/wp-json/sentinel-plugin/v1/logs?api_key=YOUR_KEY'

Endpoints

1

GET /logs

Live activity. Query: limit (1–1000, default 50), offset, event_key, priority, user_id.

2

GET /stats

Summary counts only: total_logs, today_logs, logins_today. No log rows.

3

GET /events/types

Registered keys with label, category, and priority.

Common Issues

Since v1.2.0

Activity and mail

An event is not being recorded

Issue: The type is paused, the role is skipped, or the write is still in the batch queue.

Solution:

Event Registry: make sure the type is not paused. Settings → Data & retention: the person’s role may be skipped for everyday actions (critical errors still write). If Queue writes in batches is on, rows can appear a little later.

No email for a failed sign-in

Issue: Failed logins are not emailed one by one.

Solution:

They are counted in the daily briefing. Urgent mail is only for critical events, and the same type stays quiet until the next day. Confirm Settings → Notifications and that WordPress can send mail.

A file change did not log

Issue: The daily check has not run, or the size moved by fewer than 10 bytes.

Solution:

Settings → Privacy & access → Watch critical files daily. Same-size edits can update the stored hash without file_modified. See File Monitoring.

REST returns 403

Issue: The API is off, or the key is wrong.

Solution:

Settings → Export & API → Allow read-only REST access, then generate a key. Send X-Sentinel-API-Key (or api_key). See REST API.

Frequently Asked Questions

Since v1.2.0

What does it record?

Sign-ins and failed sign-ins, content and comments, Media Library, plugins and themes, WordPress upgrades, PHP and WordPress errors, and Sentinel’s own privacy or housekeeping events. WooCommerce, Contact Form 7, and WPForms add keys when those plugins are active. Pause types in Event Registry.

Does it email every failed login?

No. Failed sign-ins are counted in the daily briefing. Urgent mail is only for critical events, and the same type will not email again until the next day.

Can I add custom events?

Not in the free plugin. Built-in types can be paused. sentinel_log_event() only writes keys Sentinel already knows. Custom Events is in the Sentinel+ plugin — remove the free plugin and install Plus if you need that editor.

Does it block attacks?

No. It records activity and can email you. The Performance rate limit caps how many log writes Sentinel will store, not visitor logins. Observe / throttle / block are in Sentinel+.

Can I watch every file?

No. The free plugin can hash wp-config.php and .htaccess once a day. That switch is under Settings → Privacy & access.

Will logging slow the site down?

Writes go into Sentinel’s own tables. If volume is a problem, Settings → Performance can queue writes in batches and cap how many events are stored per minute.

Is there a REST API?

Yes, read-only, off by default. Settings → Export & API. See REST API.

Is it compatible with multisite?

It is built for a single site. It is not tested as a network-activated plugin.

Support

Since v1.2.0

Use the contact form.

1

Include

WordPress version, PHP version, Sentinel version, and what you expected versus what happened.

2

Check first

Overview for recent activity, Event Registry if a type is paused, Settings → Notifications if mail is missing.

Sentinel+

Licence and Plus screens: remove the free plugin, install Sentinel+, then use the contact form. Licence recovery is at getsentinel.dev/recovery.

Custom Events

Since v1.1.0Sentinel+
Sentinel+

Use the Sentinel+ plugin. If the free plugin is still installed, remove it first.

Upgrade to Sentinel+

Register extra event types for site-specific activity, then log them from your own code. That editor is in Sentinel+.

Export & API

Since v1.2.0

Settings → Export & API. This download does not follow the filters on Activity Logs. It includes IP, user agent, URL, and payloads if they were stored. There is no per-user export.

1

Format

CSV, JSON, or XML.

2

Date range

Last 7, 30, or 90 days, or all stored activity.

3

Source

Live, archive, or both.

REST

The same tab can generate a read-only API key. See REST API.

Who can see Sentinel

Since v1.2.0
1

Administrators

Overview, Activity Logs, Event Registry, and Settings.

2

Editors

Overview and Activity Logs. Settings → Privacy & access → Limit what editors can see restricts them to user, content, and authentication events.

3

Role skip

Settings → Data & retention can skip everyday actions for selected roles. Critical errors are still recorded.

Plugin integrations

Since v1.2.0

Sentinel 1.2 records a small set of events from three plugins. If the plugin is active, the keys are in Event Registry and can be paused there.

WooCommerce

New orders, payments, status changes, and failed orders.

Contact Form 7

Submit, mail sent, and mail failed. Form name only, not message text.

WPForms

Form submitted. Form name only, not message text.

Keys

WooCommerce

4 keys
woo_new_order Order placed. Stores order number, total, currency, payment method, item count.
woo_payment_complete Order marked paid. Stores order number, total, payment method.
woo_order_status_changed Status changed. Stores order number, previous status, new status.
woo_payment_failed Order marked failed. Stores order number and payment method.

Contact Form 7

3 keys
cf7_form_submitted Form submitted. Stores form name, not the message.
cf7_mail_sent Notification email sent. Stores form name.
cf7_form_failed Notification email failed after submit. Stores form name.

WPForms

1 key
wpf_form_submitted Form submitted. Stores form name, not the message.

WooCommerce Integration

Since v1.2.0

Requires WooCommerce. Events appear in Event Registry while WooCommerce is active. Order number, totals, and payment method are stored. Line items and customer addresses are not.

Orders

4 keys
woo_new_order woocommerce_new_order. Order number, status, total, currency, payment method, item count.
woo_payment_complete woocommerce_payment_complete. Order number, total, payment method.
woo_order_status_changed woocommerce_order_status_changed. Order number, old status, new status.
woo_payment_failed woocommerce_order_status_failed. Order number and payment method.

Contact Form 7 Integration

Since v1.2.0

Requires Contact Form 7. Events appear in Event Registry while CF7 is active. Message body and field values are not stored.

Forms

3 keys
cf7_form_submitted wpcf7_submit. Form name.
cf7_mail_sent wpcf7_mail_sent. Form name.
cf7_form_failed wpcf7_mail_failed. Form name.

WPForms Integration

Since v1.2.0

Requires WPForms Lite or Pro. The key appears in Event Registry while WPForms is active. Message body and field values are not stored.

Forms

1 key
wpf_form_submitted wpforms_process_entry_save. Form name.