Audit Log

Administrators can review major activity under Audit Log. Access requires the administrator-only audit.read capability. Each record identifies the actor, time, action, target, and recorded result.

Recorded Activity

Area	Coverage
Authentication	Successful sign-in, explicit sign-out, and sensitive-action reauthentication
Accounts	Invitations, activation, access recovery, deletion, role/status/password changes, MFA changes, and explicit session revocation
Content	Post/Page publication-state changes, Trash, restore, permanent deletion, and Media deletion
Publishing and settings	GitHub publish results, settings saves, and credential changes
Imports	WXR chunk results and final settings application
Operations	Database upgrades, backups, restores, administrator recovery, content clearing, resets, Edge operations, and search rebuilds

Routine editing, autosaves, reads, connection tests, rejected authentication, and scheduled maintenance are not recorded. Individual comment, form, and newsletter actions are outside this record set. Bulk operations produce a summary per request rather than one record per row.

Results distinguish success, failure, partial success, unchanged data, and an unconfirmed outcome. A WXR chunk or operation start does not mean the whole workflow completed.

Actors and Grouped Operations

Records preserve the actor’s ID, name, and email as a snapshot, so deleted accounts remain identifiable and searchable. Target names and summaries also describe the action at the time it was recorded.

Search-index rebuilds appear once in the list with their latest recorded result. Open the record to inspect start, progress, and completion or failure. Date and result filters use the latest event; actor and IP filters also match earlier steps.

For work spanning requests, the initial actor is separate from the caller and connection that performed each step. Token-only operations use the actor label Operations token.

Connection Information and Retention

Data	Retention
Audit records	365 days
Original IP addresses in audit records	30 days
IP hashes, User-Agent, available location and ASN	With the record, up to 365 days

IP addresses follow Studio’s verified client IP policy. Location and ASN come from Cloudflare request metadata; Studio does not call an external geolocation service. Missing information remains unavailable.

IP hashes use a versioned HMAC with a key derived for audit IPs from STUDIO_AUTH_SECRET. They support finding records for the same address without keeping its original text indefinitely. Replacing the secret changes later hashes. If hashing fails, Studio omits the original IP as well.

Scheduled cleanup removes expired data, and reads apply the same retention limits even when cleanup is delayed. These limits apply to the live audit store, not copies already exported in backups or a logging platform’s retention.

Privacy and Availability

Records omit passwords, tokens, content bodies, and external response bodies. Settings events record field names and credential-change indicators rather than values.

Saving the audit record happens in the background. A recording failure does not undo the original action, and a record may be missing. Audit Log is an administrative history, not a tamper-proof ledger: database owners can alter the database, and restoration can rewind its history.

Database Operations

Clear Content and Reset Studio preserve audit records. SQL backups include them; a Studio restore returns history to the backup’s point in time and records completion after verification. New audit writes are paused during that restore so they do not interfere with restored data.

Uninstall removes the audit table. Its completion remains in Worker operational logs. Older activity is not reconstructed when an installation upgrades to a schema with Audit Log.