Nothing kept beyond default server logs
Who changed what is answered by memory, or not at all. Common on sites with no admin action logging built in at all.
SECURITY · LOGGING
Who did what, when, without asking anyone to remember
An audit trail is a record of every meaningful action in a system, tied to a specific account and a specific time. "SOC-ready" means that record already exists in a form an auditor could review directly, not that a system carries a SOC 2 certification.
Without one, a dispute over who changed a price or deleted a record gets settled by memory, or not at all. With one, it is a lookup.
THE RANGE OF PRACTICE
What no record looks like, and what a structured one looks like
Described by behaviour, not by a score.
A log exists somewhere, nobody reads it
Data is technically captured but scattered across tools nobody checks until something has already gone wrong.
Attributable, immutable, reviewed on a schedule
Every action tied to a specific account and time, kept in a form that can be handed to an auditor or investigator directly.
WHERE WE SIT
Attributable by default, scoped per project
Part of the same documented consistency behind our Tier 3 position.
Logging that an auditor could actually use is treated as a default consideration, not an add-on requested after something has already gone wrong. Exactly which actions are captured, where the record is stored and how long it is retained is scoped during the technical audit for each project, since a single retention period would not hold true across every system we build.
STRAIGHT ANSWERS
Questions about audit logging
The ones that come up before anyone signs anything.
A record of who did what, when, kept in a form an auditor can review without having to ask the team what happened from memory. SOC 2 is a common compliance standard that examines exactly this kind of evidence. "SOC-ready" means the record already exists in that shape, not that the system itself is SOC 2 certified.
A dispute over who changed a price, deleted a listing or accessed a customer record is not only a large-company problem. Without a log, the answer is whoever shouts loudest or whoever still remembers. With one, the record settles it in seconds.
No. A server access log records requests, not actions, and an analytics report is aggregated and anonymised by design. An audit trail records a specific action, by a specific account, at a specific time, attributable and reviewable individually.
Which actions get logged, where the record is stored and how long it is retained are scoped during the technical audit for that project, rather than fixed as one blanket figure that would not hold true for every system we build.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.