I'm attempting to log lots of WP activities to create an audit trail. I'd like to disable the plugin and theme editors entirely, but it is not an option. Those functions appear to be very light on pluggability, best option I can see is to listen to the nonce validation and filter all of them. Does anyone know of an alternate, less brittle seeming method of running a little bit of code every time the plugin or theme editor saves a file?


The ajax action that runs on theme or plugin update is edit-theme-plugin-file so you should be able to hook into it by running code on the wp_ajax_edit-theme-plugin-file hook.

add_action('wp_ajax_edit-theme-plugin-file', 'log_cowboy_coders');

function log_cowboy_coders() {
    $user = get_current_user_id();
    if (!empty($__POST['theme'])) {
        // Log that someone is editing a theme
    } else if (!empty($__POST['plugin'])) {
        //log that someone is editing a plugin
    if (!empty($__POST['file'])) {
        //log what file they are editing

the entire updated contents of that file is also included in the POST data($__POST['newcontent']) so if you run your function before default ajax action runs you could probably get the original content and save the difference between the two.

  • OP said disabling them is not an option. – WebElaine Mar 18 at 19:44
  • ^Thanks, but I want to log the action, not prevent it – wowest Mar 18 at 19:57
  • 1
    I've completely re-written the answer to solve your problem. let me know if that works for you. – mrben522 Mar 19 at 17:57
  • @mrben522 Thank you, yes this is what I need to monitor. Upvoted and greatly appreciated. – wowest Mar 28 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.