Title: ITX UserOps — User Management, Login Activity, Sessions & Audit Log Author: nanosani Published: July 18, 2026 Last modified: August 9, 2026 --- Search plugins ![](https://ps.w.org/itx-userops/assets/banner-772x250.png?rev=3639231) ![](https://ps.w.org/itx-userops/assets/icon-128x128.png?rev=3639231) # ITX UserOps — User Management, Login Activity, Sessions & Audit Log By [nanosani](https://profiles.wordpress.org/nanosani/) [Download](https://downloads.wordpress.org/plugin/itx-userops.1.9.1.zip) * [Details](https://vec.wordpress.org/plugins/itx-userops/#description) * [Reviews](https://vec.wordpress.org/plugins/itx-userops/#reviews) * [Installation](https://vec.wordpress.org/plugins/itx-userops/#installation) * [Development](https://vec.wordpress.org/plugins/itx-userops/#developers) [Support](https://wordpress.org/support/plugin/itx-userops/) ## Description WordPress has no unified user administration console. To see who is online, keep a login audit trail, force-logout a compromised account, disable a departed contractor without deleting their content, find out whether the password reset actually went out, or edit a role without deciphering sixty capability checkboxes, you normally need five or six single-purpose plugins. **ITX UserOps replaces that whole stack with one fast, cohesive console** — the kind of user administration Microsoft 365 or Google Workspace admins get out of the box. [Website](https://itxuserops.com/) | [Documentation](https://itxuserops.com/docs/getting-started/) | [All features](https://itxuserops.com/features/) | [Changelog](https://itxuserops.com/changelog/) | [Support](https://itxuserops.com/support/) #### Unified user dashboard * Every user in one table: online-now indicator, last login, last activity, active sessions, role, status, registered date, post count * Server-side search, sorting and pagination — stays fast at 100,000+ users * Quick filters that combine: role, status, online now, last login (today / 7 / 30 / 90 days / never), registered date range, inactive 30/60/90 days * Overview tiles — online now, logins today, failed logins, disabled accounts, security alerts — each clickable, drilling into the matching filtered view * Toggleable columns, per-admin [Dashboard documentation ](https://itxuserops.com/docs/console/dashboard/) #### Disable users without deleting them * One click disables an account: the user can no longer log in **on any channel**— wp-login, XML-RPC, REST, application passwords — and every active session is destroyed instantly * Content, comments and history stay intact * Customizable “account disabled” message * Safety rails: you can never disable yourself or the last administrator [Account status documentation ](https://itxuserops.com/docs/console/account-status/) #### Session management * See every active session per user: browser, OS, device, IP, signed-in time, last activity * Terminate any single session, log a user out everywhere, or log **all** users out (your own session survives) [Sessions documentation ](https://itxuserops.com/docs/console/sessions/) #### Login & user audit log * Dedicated Login Log: every sign-in attempt — success, failed or blocked — with user, IP, device, user agent, and which door it came through (login form, XML- RPC, REST API or WP-CLI) * Records logins, failed logins (with attempted username), logouts, blocked logins, registrations, deletions, role changes, password changes/resets, email and profile changes, application passwords, and bulk actions * Site visibility: content published/updated/trashed/deleted (with author and actor), plugin activations/deactivations, theme switches and WordPress core updates * **Tamper-evident**: each entry is chained to the one before it, so database-level tampering — an edited dump, SQL injection, a rogue database user — is detectable * Filter by event, user, actor, IP, severity and date; full-text search; CSV export * Configurable retention (30 days up to keep-forever) with daily auto-purge * Brute-force flood protection: failed-login noise is aggregated, never table-flooding [Activity log documentation ](https://itxuserops.com/docs/console/activity-log/)· [How tamper evidence works ](https://itxuserops.com/docs/console/tamper-evidence/) #### Email log * Every message WordPress hands to the mail server, recorded at the moment of hand- off: recipient, subject, timing, and what the server said back * Honest states: nothing is labelled “Delivered” or “Sent”, because your site cannot observe either. The good state is **Handed off**, failures carry the server’s error, and results another plugin merely claimed are shown as reported rather than observed * You choose which kinds of mail are logged — account mail on by default, high- volume kinds off — which is what keeps the log small on a busy store * Message contents are **not stored unless you switch it on** — and when you do, password reset links, one-time codes and application passwords are stripped before anything is written, so the log cannot become a way in * Its own retention setting with no “keep forever”, and one-click deletion of stored message contents [Email log documentation ](https://itxuserops.com/docs/console/email-log/) #### Role editor * WordPress permissions as a grid of **areas** (Posts, Pages, Media, Comments, Users, Site settings, Plugins & themes) against **levels** (None, View, Contribute, Manage) — instead of sixty raw checkboxes. Custom post types get their own row automatically * Draft-first: every edit collects into a draft and nothing touches the live role until you press Publish * A Plain English view of the role as toggleable statements, side-by-side role comparison, and people management — add someone to a role, move people out, reassign between roles * Capabilities the grid does not manage are never touched, and a role the grid cannot describe shows the exact difference instead of quietly rewriting it on save * “Restore WordPress defaults” puts the five built-in roles back exactly as WordPress ships them * Guardrails enforced on the server, not merely hidden in the screen: you cannot grant access you do not hold, change your own role, or demote the last administrator [Roles documentation ](https://itxuserops.com/docs/console/roles/) #### Per-user profile drawer * Click any user for an Entra-ID-style panel: overview with 30-day login sparkline, live session list, that user’s complete activity trail, and the mail sent to them — without leaving the page [Profile drawer documentation ](https://itxuserops.com/docs/console/profile-drawer/) #### Bulk actions * Multi-select users change role, disable, enable, log out, send password reset, delete with content reassignment, export to CSV * Runs in batches with a progress bar — no timeouts on large sites [Bulk actions documentation ](https://itxuserops.com/docs/console/bulk-actions/) #### Works behind Cloudflare and reverse proxies * Behind a CDN, load balancer or reverse proxy, logs normally record the proxy’s address instead of the visitor’s. Name your proxy (Cloudflare’s ranges are built in) and the real client IP is recorded instead * Forwarding headers are only trusted when the request genuinely arrives from a configured range, so they cannot be forged [Client IP documentation ](https://itxuserops.com/docs/console/proxies/) #### Privacy and GDPR * GDPR mode zeroes the last part of every captured IP before it is stored * Log retention is capped and auto-purged; email bodies are opt-in and redacted * Uninstalling can remove every trace of plugin data — your choice, off by default [Privacy documentation ](https://itxuserops.com/docs/reference/privacy/) #### Extras * Live “online users” count in the admin bar and a user-overview dashboard widget * Online status and a UserOps details link right in the native Users screen * Works on multisite — each subsite gets its own console ([multisite notes ](https://itxuserops.com/docs/console/multisite/)) #### Performance Built to a strict budget: front-end requests incur at most one throttled database write per user per minute — no admin-ajax polling, no autoloaded bloat. Logs live in their own indexed tables, never in wp_options. The plugin makes no external HTTP requests and loads no remote assets. [Performance notes ](https://itxuserops.com/docs/reference/performance/) #### Free, and complete Everything described above is free, fully functional, and stays that way. A separate premium edition exists for security teams — two-factor enforcement, passkeys, security alerts, temporary accounts, delegation and more — described at [itxuserops.com/pricing](https://itxuserops.com/pricing/). Nothing on this page requires it. ### Development The admin interface is a React app built with @wordpress/scripts. The human-readable source lives in `assets/src/`; the compiled bundle in assets/build/ is generated with: ``` npm install && npm run build ``` No third-party JavaScript libraries are bundled — the app uses the @wordpress/* packages that ship with WordPress core. The plugin makes no external HTTP requests and loads no remote assets. ## Screenshots [⌊User dashboard — who is online, logins, security alerts, role breakdown and recent activity in one view⌉⌊User dashboard — who is online, logins, security alerts, role breakdown and recent activity in one view⌉[ User dashboard — who is online, logins, security alerts, role breakdown and recent activity in one view [⌊Per-user profile drawer with sessions, devices, activity and one-click account actions⌉⌊Per-user profile drawer with sessions, devices, activity and one-click account actions⌉[ Per-user profile drawer with sessions, devices, activity and one-click account actions [⌊Login log — successes, failures, blocked attempts and logouts charted over 14 days⌉⌊Login log — successes, failures, blocked attempts and logouts charted over 14 days⌉[ Login log — successes, failures, blocked attempts and logouts charted over 14 days [⌊Failed-login detail with IP address, user agent and aggregated attack counts⌉⌊ Failed-login detail with IP address, user agent and aggregated attack counts⌉[ Failed-login detail with IP address, user agent and aggregated attack counts [⌊Activity log with per-severity charts and filtering by event, severity, IP and date⌉⌊Activity log with per-severity charts and filtering by event, severity, IP and date⌉[ Activity log with per-severity charts and filtering by event, severity, IP and date [⌊Activity entry detail — who changed what, from where, with the full metadata⌉⌊ Activity entry detail — who changed what, from where, with the full metadata⌉[ Activity entry detail — who changed what, from where, with the full metadata [⌊Email log — what the site sent and what the mail server said, with per-message detail⌉⌊Email log — what the site sent and what the mail server said, with per-message detail⌉[ Email log — what the site sent and what the mail server said, with per-message detail [⌊Role editor — areas and levels instead of raw capabilities, with drafts and compare⌉⌊ Role editor — areas and levels instead of raw capabilities, with drafts and compare⌉[ Role editor — areas and levels instead of raw capabilities, with drafts and compare [⌊The raw capability list, one click away and always in step with the grid⌉⌊The raw capability list, one click away and always in step with the grid⌉[ The raw capability list, one click away and always in step with the grid [⌊Settings — staff detection, log retention, email logging, IP detection and privacy controls⌉⌊Settings — staff detection, log retention, email logging, IP detection and privacy controls⌉[ Settings — staff detection, log retention, email logging, IP detection and privacy controls ## Installation #### Minimum requirements * WordPress 6.0 or newer * PHP 7.4 or newer * Works on single sites and multisite networks [Requirements in detail ](https://itxuserops.com/docs/getting-started/requirements/) #### Installing from your WordPress dashboard (recommended) 1. Sign in to your WordPress admin and go to **Plugins Add New Plugin** 2. Search for **ITX UserOps** 3. Click **Install Now**, then **Activate** #### Installing by upload 1. Download the plugin zip from this page 2. In your WordPress admin, go to **Plugins Add New Plugin Upload Plugin** 3. Choose the zip, click **Install Now**, then **Activate** Or unzip it into `wp-content/plugins/` over SFTP and activate from the Plugins screen. [Installation guide ](https://itxuserops.com/docs/getting-started/install/) #### After activation Activation changes nothing on your site: no role is edited, no email is sent, no existing data is touched. The console appears as **ITX UserOps** in the admin menu— open the Dashboard and your users, sessions and logs are already there; recording starts from the moment the plugin is active. A guided tour of what to look at first — the dashboard, the login log, retention settings, and proxy configuration if you are behind Cloudflare — is in [Your first hour ](https://itxuserops.com/docs/getting-started/first-hour/) #### Updating Update from the Plugins screen like any other plugin. Database schema upgrades run automatically and every step is additive — existing log entries stay readable. #### Uninstalling Deactivating stops all recording and clears the plugin’s scheduled tasks. Uninstalling keeps your data by default; if you want a complete removal, enable **Delete all plugin data on uninstall** in ITX UserOps Settings first, and uninstalling then removes every table, option and user-meta entry the plugin ever created. ## FAQ ### How do I disable a WordPress user without deleting them? Open ITX UserOps Dashboard, find the user, and choose “Disable account” from the row menu. They immediately lose access on every login channel while their content and history remain untouched. Re-enable them any time. ### How do I log out all WordPress users at once? ITX UserOps Dashboard “Log out all users”. Every session on the site is destroyed except your current one. ### How can I see who is currently online? The dashboard’s “Online” column shows a live indicator for every user with activity in the last 5 minutes, and the “Online now” filter lists exactly who is connected. ### Does it slow down my site? No. Visitors trigger zero extra queries. Logged-in users trigger at most one tiny indexed write per minute. All heavy lifting happens only on the plugin’s own admin pages. ### Is it GDPR friendly? Yes. Enable “Anonymize IP addresses” and the last octet of every captured IP is zeroed before storage. Log retention is capped and auto-purged, and uninstalling can remove every trace of plugin data. ### Does it work on multisite? Yes — each subsite gets its own dashboard, log and settings. Subsite admins cannot disable super admins. ### Where is the audit log stored? In its own indexed database table — not in wp_options or postmeta — so a busy log never slows down the rest of your site. ## Reviews ![](https://secure.gravatar.com/avatar/ab608a4f2304624ea344b4eb1e9018a364c7bff5571424f37758446ecf9b0ca4? s=60&d=retro&r=g) ### 󠀁[From now onwards, its in my essential plugins kit!](https://wordpress.org/support/topic/from-now-onwards-its-in-my-essential-plugins-kit/)󠁿 [Abdul Wahab](https://profiles.wordpress.org/abdulwahab12197/) July 20, 2026 Excellent plugin for managing and monitoring WordPress users. The login history is clear and very helpful for tracking user access. I especially like the ability to disable accounts and log users out instantly without affecting their content. Highly recommended. [ Read all 1 review ](https://wordpress.org/support/plugin/itx-userops/reviews/) ## Contributors & Developers “ITX UserOps — User Management, Login Activity, Sessions & Audit Log” is open source software. The following people have contributed to this plugin. Contributors * [ nanosani ](https://profiles.wordpress.org/nanosani/) [Translate “ITX UserOps — User Management, Login Activity, Sessions & Audit Log” into your language.](https://translate.wordpress.org/projects/wp-plugins/itx-userops) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/itx-userops/), check out the [SVN repository](https://plugins.svn.wordpress.org/itx-userops/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/itx-userops/) by [RSS](https://plugins.trac.wordpress.org/log/itx-userops/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.9.1 The first update on WordPress.org since 1.0.0, condensing the development releases in between. What is new compared to 1.0.0: * New: Roles. WordPress permissions described the way people think about them — a grid of areas (Posts, Pages, Media, Comments, Users, Site settings, Plugins& themes) against levels (None, View, Contribute, Manage) instead of sixty raw checkboxes. Custom post types get their own row automatically. * Roles is draft-first: every edit collects into a draft, a bar counts the changes, and nothing touches the live role until you press Publish. Leaving with a draft open prompts you like any unsaved form. * Alongside the grid: a Plain English view of the role as toggleable statements, side-by-side role comparison with differences highlighted, people management ( add someone to a role, move people out, reassign between roles), create/duplicate/ rename/delete, and “Restore WordPress defaults” for the five built-in roles. * Capabilities the grid does not manage are never touched — if WooCommerce or a membership plugin added something to a role, saving leaves it byte-for-byte. A role the grid cannot describe reads “Custom” and shows the exact difference instead of quietly rewriting it on save. * Role guardrails are enforced on the server, not merely hidden in the screen: you cannot grant access you do not hold yourself, change your own role, or demote the last administrator. The administrator role is visible but not editable. Activation changes nothing until you choose to change it. * New: an Email Log. Every message WordPress hands to the mail server is recorded— recipient, subject, timing, and what the server said back. Nothing is labelled“ Delivered” or “Sent”, because your site cannot observe either: the good state is “Handed off”, failures carry the server’s error, and results another plugin merely claimed are shown as reported rather than observed. * You choose which kinds of mail are logged; account mail and the plugin’s own mail are on by default, high-volume kinds are off. Message contents are not stored unless you switch it on — and when you do, password reset links, one-time codes and application passwords are stripped before anything is written, so the log cannot become a way in. Stored contents can be deleted again in one click. * New: client IP detection behind Cloudflare, a load balancer or another reverse proxy (Cloudflare’s ranges are built in). Forwarding headers are only trusted when the request genuinely arrives from a configured range, so they cannot be forged. * New: the activity log is tamper-evident. Each entry is chained to the one before it, so database-level tampering — an edited dump, SQL injection, a rogue database user — is detectable, and legitimate retention deletion records itself so it is never mistaken for interference. * New: the activity log records which door a sign-in attempt came through — the login form, XML-RPC, the REST API or WP-CLI — shown as “Signed in via” in the event details. * New: each user’s profile panel gains an Emails tab beside Overview, Sessions and Activity; log rows on every screen open a keyboard-accessible side panel; every dashboard overview tile drills into its matching filtered view. * Fixed: repeat login lockouts now double in length as intended — the record the escalation counted from was being deleted the moment a lock expired, so an attacker could simply wait out the shortest lockout and go again. * Fixed: changing roles from the bulk actions bar, which failed on every site, and bulk-action failures that closed the toolbar without saying why. * Performance: the online-users counter, dashboard counts and activity-log totals are cached instead of recomputed on every admin page load, session cleanup and IP searches are indexed, and the dashboard no longer counts every user account per visit. * Database schema upgrades from version 1 to 6 run automatically on update; every step is additive and existing entries stay readable. The full release-by-release history is at https://itxuserops.com/changelog/ #### 1.0.0 * Initial release: unified user dashboard, enable/disable accounts, device-grouped session management, activity & login audit log, profile drawer, bulk actions with CSV export, admin-bar online counter, user-overview dashboard widget, and native Users-screen integration. ## Meta * Version **1.9.1** * Last updated **4 days ago** * Active installations **10+** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.4** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/itx-userops/) * Tags * [audit log](https://vec.wordpress.org/plugins/tags/audit-log/)[disable users](https://vec.wordpress.org/plugins/tags/disable-users/) [login activity](https://vec.wordpress.org/plugins/tags/login-activity/)[user management](https://vec.wordpress.org/plugins/tags/user-management/) [user sessions](https://vec.wordpress.org/plugins/tags/user-sessions/) * [Advanced View](https://vec.wordpress.org/plugins/itx-userops/advanced/) ## Ratings 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/itx-userops/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/itx-userops/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/itx-userops/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/itx-userops/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/itx-userops/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/itx-userops/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/itx-userops/reviews/) ## Contributors * [ nanosani ](https://profiles.wordpress.org/nanosani/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/itx-userops/)