WordPress core gives you hooks for a lot of individual events — wp_login_failed ,

activated_plugin , profile_update — but no unified log. If you want to answer "what changed on

this site, and when," you're stitching together a dozen separate hooks yourself, or you're

guessing after the fact and hoping the answer is still in a log file somewhere.

The hooks worth capturing for a basic audit trail

You don't need to log everything WordPress fires — most of it is noise. A useful baseline audit

trail covers:

activated_plugin / deactivated_plugin — plugin changes are one of the most common vectors for "something changed and nobody admits to it."

switch_theme — same reasoning, lower frequency, still worth knowing.

set_user_role — privilege changes are the single highest-value thing to audit on any multi-admin site.

profile_update and added_user_meta filtered to role-adjacent meta keys — catches privilege escalation that doesn't go through set_user_role directly.

wp_login / wp_login_failed — who got in,…