DooFiles
Activity
The DooFiles activity log: who did what with your files and when, from which IP address, including the actions that DooFiles blocked, and how long the entries are kept.
Overview
DooFiles records every action done with it: who opened, saved, uploaded, moved or deleted a file, when, and from which IP address. It also records the attempts it blocked or refused, such as a wrong password or an access to a private folder by someone who is not on its list.
Use the activity log to find out what changed after a problem, or to check that nobody is doing something unexpected on your site.
Open the activity log
Click Activity in the folder panel. The newest entries come first. The log loads 50 entries at a time: click Load more at the bottom to see older ones.
[SCREENSHOT_HERE: The Activity view with several entries, including a Saved file, a Password confirmation and a Blocked access attempt with its status label]
What each entry shows
| Column | What it shows |
|---|---|
| Date | When it happened |
| User | The WordPress user who did it |
| Action | What was done, such as Saved or Moved to trash. Entries that did not succeed show a label: Failed, Blocked or Denied |
| Path | The file or folder. For a move or a rename, also where it went. For a change of settings, each setting with its value before and after |
| IP | The IP address the action came from |
IP addresses behind a proxy
If your site is behind a proxy or a CDN, such as Cloudflare, the IP column shows the address that the proxy reported, followed by the address of the proxy: 203.0.113.5 (via 172.69.90.106). The address reported by the proxy is a reference only, because it can be faked. The address in parentheses is the one that connected to your server.
What is recorded
| Group | Actions |
|---|---|
| Files | Opened, Saved, Uploaded, Downloaded, Created, Renamed, Moved, Moved to trash, Restored from trash, Deleted permanently, Compressed, Extracted, Restored a version, Previewed, Thumbnail and Edited image. Thumbnail means your browser read a video once to take the frame of its thumbnail. Edited image is an image saved from the media viewer, as a copy or in place of the original |
| Security | Password confirmation (correct and wrong), Locked and Access attempt |
| License | License activated, License deactivated and License released by Doothemes |
| Settings | Changed settings, with each value before and after. Deleted thumbnails, when someone deletes all thumbnails, with how many |
| Private folders | Made a folder private, Changed who opens a private folder, Made a private folder public, Claimed a private folder and Private folder check |
| Scans | Integrity check, when the file integrity check finds files that do not match. Skipped a folder too large to measure, with the folder, when the Space scan had to skip it (DooFiles 1.0.19 or newer) |
| Second factor | Turned on the second factor, Turned off the second factor, Used a recovery code, Got new recovery codes and Reset the second factor of another administrator |
| Cloudflare R2 | Saved the Cloudflare R2 keys (never the keys themselves), Added a Cloudflare R2 bucket, Removed a Cloudflare R2 bucket, Cloudflare R2 bucket check (when a check fails), Disconnected Cloudflare R2 and Copied between the site and Cloudflare R2, with how many files were copied (DooFiles 1.1.0 or newer). What you do inside a bucket appears with the same actions as on your site, such as Uploaded, Renamed or Moved to trash. See Cloudflare R2 |
| Mobile access | Made a code to connect a device, Connected a device, Disconnected a device and A device tried to open a file, with the name of the device (DooFiles 1.0.13 or newer). What a connected device views, downloads and uploads appears as Previewed, Downloaded and Uploaded, and what it organizes as Created, Renamed, Moved, Moved to trash and Restored from trash (DooFiles 1.0.14 or newer), with the name of the device in the details. See Mobile access |
Opening a folder, searching and looking at the versions of a file are not recorded when they work, to keep the log focused on changes. They appear only when DooFiles blocks or refuses them, as Opened folder, Searched or Viewed versions with a status label.
Blocked and refused attempts
| Label | What it means |
|---|---|
| Failed | A wrong password or authenticator code in a password confirmation |
| Blocked | DooFiles stopped the action on purpose: a path that tried to leave the folder of WordPress, an unsafe zip file, a private folder that is not theirs, or a password confirmation locked after too many wrong attempts |
| Denied | A signed-in user who is not allowed to use DooFiles, such as an editor, tried to reach it. It shows as Access attempt |
Several Password confirmation entries with Failed in a row, or Access attempt entries you do not recognize, are worth a look. After five wrong passwords in a row, DooFiles locks the confirmation for 15 minutes. See Password confirmation.
Private folders
The actions inside a private folder are recorded like any other. Administrators who are not on the list of that folder see that something happened, but not the path: the Path column shows In a private folder.
[SCREENSHOT_HERE: An entry of the Activity view with In a private folder and a padlock in the Path column]
How long entries are kept
DooFiles keeps entries for 90 days, and at most 50,000 entries, by default. Older entries are deleted on their own once a day. Change both in DooFiles › Files. See Trash, backups and activity.
The activity log cannot be emptied from DooFiles. This is on purpose: if someone got into an administrator account, they could not erase what they did. Every change to the retention settings is itself recorded, with the value before and after.
Troubleshooting
| Problem | What to do |
|---|---|
| No activity yet | Nothing has been done with DooFiles since it was installed, or the entries expired |
| An older action is missing | It was deleted when it passed the days or the number of entries you keep. Raise them in Trash, backups and activity |
| The Path column shows In a private folder | The action happened in a private folder that is not yours. Ask an administrator on its list |
| The IP column shows a Cloudflare address | Your site is behind a proxy. The address before via is the one the proxy reported |
| Many Password confirmation entries with Failed | Someone typed a wrong password several times. If it was not you, change your password and turn on your second factor |
Need more help? Open a support ticket.
The product
DooFiles — Secure WordPress file manager plugin
The file manager WordPress should have shipped with: native, fast and secure by design.
Features and pricing