AccessTrail – Admin Login & Security Monitor
A lightweight WordPress security plugin that tracks successful admin logins, failed login attempts, IP addresses, user agents, and suspicious access activity through a clean admin dashboard. AccessTrail is a professional WordPress security plugin built to help website owners and administrators monitor backend access activity. It records successful administrator logins, failed login attempts, IP addresses, user-agent data, login timestamps, and security-related events inside a clean WordPress admin dashboard.
The Problem
WordPress websites often lack clear visibility into who accessed the admin dashboard, when the access happened, which IP address was used, and whether there are repeated failed login attempts. Without a dedicated log and alert system, suspicious access patterns can be missed.
The Solution
AccessTrail provides a dedicated admin login monitoring system inside WordPress. It logs successful admin logins, failed login attempts, IP activity, user-agent details, and provides configurable email notifications, new IP alerts, failed attempt threshold alerts, filters, CSV export, and automatic log cleanup.
Key Features
- Successful admin login tracking
- Failed login attempt monitoring
- IP address logging
- User-Agent logging
- New IP detection alerts
- Configurable email notifications
- Failed login threshold alerts
- Filterable login activity dashboard
- Pagination for large log datasets
- CSV export with active filter support
- Automatic log retention cleanup using WP-Cron
- Secure IP detection with optional Cloudflare / proxy support
- Multisite compatible with Super Admin detection
- No passwords or sensitive credentials stored
- Translation-ready with WordPress i18n support
What I actually built
- Custom WordPress plugin structure
- Activation and deactivation hooks
- Custom database table for login logs
- Successful admin login tracking using WordPress login hooks
- Failed login attempt tracking
- Admin-only dashboard for login activity
- Statistics cards for total events, successful logins, failed attempts, last success, and last failed attempt
- Filters by status, username, IP address, and date range
- CSV export flow with nonce validation
- Clear all logs action with confirmation dialog
- Settings page for email notifications and security preferences
- New IP detection logic per admin user
- Failed attempt threshold notification system
- Daily WP-Cron cleanup for old logs
- Secure sanitization, escaping, prepared SQL statements, nonce checks, and capability checks
- Optional data deletion on uninstall
- GitHub updater fallback and plugin information support
Learning / Note
This project focused on building a practical WordPress security monitoring tool with a clean admin experience. The main challenge was balancing useful access tracking with safe data handling, secure IP detection, configurable alerts, and a simple dashboard that site owners can understand quickly.
Security Notes
AccessTrail does not store passwords or sensitive credentials. It only records security-relevant metadata such as username, user ID, login status, IP address, user-agent, timestamps, and internal event details. All admin actions are protected using WordPress capabilities and nonce checks.