User Login Log WordPress Plugin – Features & Review | WPWizzy

User Login Log hooks into the WordPress wp_login action to capture logins. Some plugins that implement custom login flows or single sign-on bypass the standard WordPress login process and may not trigger this hook. If logins through WooCommerce customer login, social login plugins, or SSO are not being recorded, the login is happening outside the standard flow. Check whether the missing logins use a custom authentication method and contact the plugin developer about compatibility with the wp_login hook.

An IP address of 127.0.0.1 means the site is reading the server’s own IP rather than the visitor’s IP. This happens when the site is behind a load balancer or reverse proxy (including Cloudflare) that does not forward the original client IP. The real IP is usually in the X-Forwarded-For or CF-Connecting-IP HTTP header. Some versions of the plugin have a setting to read from these headers. If not, this is a server configuration issue that may require adjusting how your hosting passes client IP information.

Login logs accumulate indefinitely without automatic cleanup. If the log table has grown very large, clear old entries from the admin log screen or directly in the database using phpMyAdmin. Consider exporting the log to CSV before deleting entries if you need to retain the records. After clearing, check whether the plugin has a setting to limit log retention to a certain number of days or entries.

Most versions of User Login Log include a CSV export option in the log admin screen. Click the export button to download all current log entries as a CSV file. The CSV includes username, IP address, browser, login time, and logout time for each recorded session. For compliance purposes such as GDPR data subject requests or security incident documentation, this export provides the necessary login history data.

Basic versions of User Login Log do not include email alerting. For login alerts, WP Activity Log Pro includes notification rules that send emails when specific users log in, or when logins occur from new IP addresses. Alternatively, security plugins like Wordfence include login alerts as part of their broader security monitoring feature set.

User Login Log records only login and logout events. WP Activity Log records all admin actions — post edits, user profile changes, plugin activations, settings modifications, file changes, and login events. WP Activity Log is more comprehensive and useful for full admin accountability tracking. User Login Log is a lighter option if you only need login monitoring without the overhead of logging every admin action.

Some versions of User Login Log show active sessions in the log. For explicit current session management, the WordPress core includes a Sessions section in each user profile that shows active login sessions. You can terminate specific sessions from there. The Terminate All Sessions function in WordPress core is also useful for forcing all users to log out simultaneously after a security concern.

User Login Log records successful logins by hooking into wp_login which only fires on success. Failed login attempts fire a different hook (wp_login_failed). Basic versions of User Login Log do not record failed attempts. For failed login monitoring, security plugins like Wordfence or Limit Login Attempts Reloaded record failed attempts and can block IP addresses after too many failures.

Retention period depends on your use case. For security incident response, having at least 90 days of login history is useful. For compliance in regulated industries, specific retention periods may be legally required — check your relevant regulations. For general admin visibility, 30 days is often sufficient. Set a consistent retention policy and clear older records on schedule to prevent the log table from growing without bound.