# Activity > The DooFiles activity log: who did what with your files and when, from which IP address, including the actions that DooFiles blocked, and how long the entries are kept. Source: https://doothemes.com/docs/doofiles/views/activity --- ## Overview DooFiles records every action done with it: who opened, saved, uploaded, moved or deleted a file, when, and from which IP address. It also records the attempts it blocked or refused, such as a wrong password or an access to a private folder by someone who is not on its list. Use the activity log to find out what changed after a problem, or to check that nobody is doing something unexpected on your site. ## Open the activity log Click **Activity** in the folder panel. The newest entries come first. The log loads 50 entries at a time: click **Load more** at the bottom to see older ones. [SCREENSHOT_HERE: The Activity view with several entries, including a Saved file, a Password confirmation and a Blocked access attempt with its status label] ## What each entry shows | Column | What it shows | |---|---| | **Date** | When it happened | | **User** | The WordPress user who did it | | **Action** | What was done, such as *Saved* or *Moved to trash*. Entries that did not succeed show a label: *Failed*, *Blocked* or *Denied* | | **Path** | The file or folder. For a move or a rename, also where it went. For a change of settings, each setting with its value before and after | | **IP** | The IP address the action came from | ### IP addresses behind a proxy If your site is behind a proxy or a CDN, such as Cloudflare, the IP column shows the address that the proxy reported, followed by the address of the proxy: *203.0.113.5 (via 172.69.90.106)*. The address reported by the proxy is a reference only, because it can be faked. The address in parentheses is the one that connected to your server. ## What is recorded | Group | Actions | |---|---| | **Files** | Opened, Saved, Uploaded, Downloaded, Created, Renamed, Moved, Moved to trash, Restored from trash, Deleted permanently, Compressed, Extracted, Restored a version and Previewed | | **Security** | Password confirmation (correct and wrong), Locked and Access attempt | | **License** | License activated, License deactivated and License released by Doothemes | | **Settings** | Changed settings, with each value before and after | | **Private folders** | Made a folder private, Changed who opens a private folder, Made a private folder public, Claimed a private folder and Private folder check | | **Second factor** | Turned on the second factor, Turned off the second factor, Used a recovery code, Got new recovery codes and Reset the second factor of another administrator | Opening a folder, searching and looking at the versions of a file are not recorded when they work, to keep the log focused on changes. They appear only when DooFiles blocks or refuses them, as *Opened folder*, *Searched* or *Viewed versions* with a status label. ### Blocked and refused attempts | Label | What it means | |---|---| | *Failed* | A wrong password or authenticator code in a password confirmation | | *Blocked* | DooFiles stopped the action on purpose: a path that tried to leave the folder of WordPress, an unsafe zip file, a private folder that is not theirs, or a password confirmation locked after too many wrong attempts | | *Denied* | A signed-in user who is not allowed to use DooFiles, such as an editor, tried to reach it. It shows as *Access attempt* | Several *Password confirmation* entries with *Failed* in a row, or *Access attempt* entries you do not recognize, are worth a look. After five wrong passwords in a row, DooFiles locks the confirmation for 15 minutes. See [Password confirmation](https://doothemes.com/docs/doofiles/security/password-confirmation). ## Private folders The actions inside a [private folder](https://doothemes.com/docs/doofiles/security/private-folders) are recorded like any other. Administrators who are not on the list of that folder see that something happened, but not the path: the Path column shows *In a private folder*. [SCREENSHOT_HERE: An entry of the Activity view with In a private folder and a padlock in the Path column] ## How long entries are kept DooFiles keeps entries for 90 days, and at most 50,000 entries, by default. Older entries are deleted on their own once a day. Change both in **DooFiles › Settings**. See [Retention](https://doothemes.com/docs/doofiles/settings/retention). The activity log cannot be emptied from DooFiles. This is on purpose: if someone got into an administrator account, they could not erase what they did. Every change to the retention settings is itself recorded, with the value before and after. ## Troubleshooting | Problem | What to do | |---|---| | *No activity yet* | Nothing has been done with DooFiles since it was installed, or the entries expired | | An older action is missing | It was deleted when it passed the days or the number of entries you keep. Raise them in [Retention](https://doothemes.com/docs/doofiles/settings/retention) | | The Path column shows *In a private folder* | The action happened in a private folder that is not yours. Ask an administrator on its list | | The IP column shows a Cloudflare address | Your site is behind a proxy. The address before *via* is the one the proxy reported | | Many *Password confirmation* entries with *Failed* | Someone typed a wrong password several times. If it was not you, change your password and turn on your [second factor](https://doothemes.com/docs/doofiles/security/second-factor) | Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).