DooFiles
Activity
The DooFiles activity log: who did what with your files and when, from which IP address, including the actions that DooFiles blocked, and how long the entries are kept.
Overview
DooFiles records every action done with it: who opened, saved, uploaded, moved or deleted a file, when, and from which IP address. It also records the attempts it blocked or refused, such as a wrong password or an access to a private folder by someone who is not on its list.
Use the activity log to find out what changed after a problem, or to check that nobody is doing something unexpected on your site.
Open the activity log
Click Activity in the folder panel. The newest entries come first. The log loads 50 entries at a time: click Load more at the bottom to see older ones.
[SCREENSHOT_HERE: The Activity view with several entries, including a Saved file, a Password confirmation and a Blocked access attempt with its status label]
What each entry shows
| Column | What it shows |
|---|---|
| Date | When it happened |
| User | The WordPress user who did it |
| Action | What was done, such as Saved or Moved to trash. Entries that did not succeed show a label: Failed, Blocked or Denied |
| Path | The file or folder. For a move or a rename, also where it went. For a change of settings, each setting with its value before and after |
| IP | The IP address the action came from |
IP addresses behind a proxy
If your site is behind a proxy or a CDN, such as Cloudflare, the IP column shows the address that the proxy reported, followed by the address of the proxy: 203.0.113.5 (via 172.69.90.106). The address reported by the proxy is a reference only, because it can be faked. The address in parentheses is the one that connected to your server.
What is recorded
| Group | Actions |
|---|---|
| Files | Opened, Saved, Uploaded, Downloaded, Created, Renamed, Moved, Moved to trash, Restored from trash, Deleted permanently, Compressed, Extracted, Restored a version and Previewed |
| Security | Password confirmation (correct and wrong), Locked and Access attempt |
| License | License activated, License deactivated and License released by Doothemes |
| Settings | Changed settings, with each value before and after |
| Private folders | Made a folder private, Changed who opens a private folder, Made a private folder public, Claimed a private folder and Private folder check |
| Second factor | Turned on the second factor, Turned off the second factor, Used a recovery code, Got new recovery codes and Reset the second factor of another administrator |
Opening a folder, searching and looking at the versions of a file are not recorded when they work, to keep the log focused on changes. They appear only when DooFiles blocks or refuses them, as Opened folder, Searched or Viewed versions with a status label.
Blocked and refused attempts
| Label | What it means |
|---|---|
| Failed | A wrong password or authenticator code in a password confirmation |
| Blocked | DooFiles stopped the action on purpose: a path that tried to leave the folder of WordPress, an unsafe zip file, a private folder that is not theirs, or a password confirmation locked after too many wrong attempts |
| Denied | A signed-in user who is not allowed to use DooFiles, such as an editor, tried to reach it. It shows as Access attempt |
Several Password confirmation entries with Failed in a row, or Access attempt entries you do not recognize, are worth a look. After five wrong passwords in a row, DooFiles locks the confirmation for 15 minutes. See Password confirmation.
Private folders
The actions inside a private folder are recorded like any other. Administrators who are not on the list of that folder see that something happened, but not the path: the Path column shows In a private folder.
[SCREENSHOT_HERE: An entry of the Activity view with In a private folder and a padlock in the Path column]
How long entries are kept
DooFiles keeps entries for 90 days, and at most 50,000 entries, by default. Older entries are deleted on their own once a day. Change both in DooFiles › Settings. See Retention.
The activity log cannot be emptied from DooFiles. This is on purpose: if someone got into an administrator account, they could not erase what they did. Every change to the retention settings is itself recorded, with the value before and after.
Troubleshooting
| Problem | What to do |
|---|---|
| No activity yet | Nothing has been done with DooFiles since it was installed, or the entries expired |
| An older action is missing | It was deleted when it passed the days or the number of entries you keep. Raise them in Retention |
| The Path column shows In a private folder | The action happened in a private folder that is not yours. Ask an administrator on its list |
| The IP column shows a Cloudflare address | Your site is behind a proxy. The address before via is the one the proxy reported |
| Many Password confirmation entries with Failed | Someone typed a wrong password several times. If it was not you, change your password and turn on your second factor |
Need more help? Open a support ticket.