Features
The flight recorder for your WordPress site — plus the alarm.
Real-time off-server shipping
Security events leave the server in seconds via a fire-and-forget collector (3s timeout, non-blocking) — it never slows your site, even if our cloud is unreachable.
Append-only hash-chained log
Each entry seals to the previous with SHA-256. The verify endpoint recomputes the whole chain on demand. Tamper-evident — we say exactly what that means, no “unhackable” claims.
Hack alert rules
new_admin_user (critical), file_changed (high), failed_login_spike — 10+ failures in 5 min (high), plugin_installed (medium). Durably logged per site; optionally POSTed to your webhook.
WordPress collector plugin
Single-file plugin, Settings → AuditVault for the API key + endpoint. Ships logins, user/role changes, plugin/theme changes, watched option updates, and an hourly heartbeat (silence is a signal).
Retention per plan
90 days (Single), 1 year (Pro), 2 years (Agency). Export your full log as CSV anytime — it's your evidence.
Weekly integrity reports (Pro+, roadmap)
On the roadmap. Today the verify endpoint recomputes your whole hash chain on demand — the same proof, whenever you ask for it.
How we compare
Competitor prices verified October 2026.
| Tool | Entry price | The catch |
|---|---|---|
| AuditVault Single | $9/mo | Off-server, tamper-evident log + hack alerts, managed |
| WP Activity Log Premium | from $139/yr [verified Oct 2026] | Stores logs in the site's own database; external mirroring is self-managed |
| Simple History / Stream | free | 100% on-server — blind the moment the server is compromised |