To detect unauthorized website changes, establish what work was approved, give each contractor a separate least-privilege account, and compare application, hosting, deployment, and public-page records against that approval and a known-good baseline. Treat a log entry as evidence of an event by an account or system—not proof of which person acted or what they intended.
Define what counts as authorized
Before work begins, write down the contractor’s identity, individual account, role, systems they may access, assigned tasks, approval contact, and expected work window. Use separate named accounts rather than a shared administrator login. Grant only the permissions needed for the assignment, require appropriate authentication, and review or disable access when the work ends or its scope changes.
Set a change path: request, approval, implementation, review, and release. Record approved work and maintenance windows so scheduled updates are distinguishable from unexplained events. For higher-impact changes, use a staging environment and have a named owner approve promotion to production. CMS access-control guidance for federal systems offers a useful security example, but it is not automatically binding on every private website: CISA CMS security guidance.
How can I tell what a web developer changed on my website?
Start with the records closest to the change, then correlate them. A useful event record identifies when something happened, which account or system performed it, what component or object was affected, what type of event occurred, and whether it succeeded. Include the time zone and, when available, the source address and before-and-after values.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Check the CMS activity history and revisions
Enable native revisions and activity history where available. In WordPress, revisions can help compare content versions; activity-log tools may record content edits, account and role changes, settings, plugin or theme actions, and other events. Coverage depends on the WordPress version, plugin, page builder, integrations, and route used to make the change. Confirm the event documentation for your setup rather than assuming a plugin records every action.
For example, the WordPress.org listing for WP Activity Log describes event details including time, user or role, source IP, and affected object, as well as content, account, settings, plugin/theme, and file activity. It states that default retention is three months and configurable, and describes premium export and external log storage or mirroring. Verify current features, edition limits, retention settings, permissions, and compatibility before relying on those capabilities.
The WordPress.org listing for Simple History describes a timeline, before-and-after content details, user changes, plugin events, and Site Editor event logging. Its listing notes Site Editor event logging in release notes dated August 2026; that is a vendor-maintained listing statement, not an independent comparative test. It says logs are stored in the WordPress database and can be exported.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Correlate events beyond the CMS
A change may bypass the CMS. Review hosting control-panel, SSH/SFTP, server, database, identity-provider, and deployment logs where available. Check version-control history and compare code or configuration with a clean baseline. For important files, file-integrity monitoring can surface additions and modifications that a CMS activity log misses.
WordPress’s hardening guidance discusses revision control, system utilities, kernel-level monitoring, and OSSEC as possible approaches to monitoring files. It also notes that external integrity monitoring can help detect defacement: WordPress Developer Resources: Hardening WordPress.
Compare the public site with a known-good view
Periodically capture important public pages and compare them with an approved snapshot or baseline. This can reveal visible changes such as altered text, unexpected links, or a defaced page. It cannot reliably identify the person or account responsible, and it may miss changes hidden behind authentication or not rendered in the captured view.
Rank #3
- Used Book in Good Condition
ScreenshotNeo is a website screenshot API and MCP server for developers. Its clean-shot options accept cookie/consent banners and remove supported consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. A screenshot can support visual comparison, but it is not a substitute for CMS, hosting, or deployment audit records. See ScreenshotNeo.
How do I track changes made by a contractor in WordPress?
- Use a named WordPress account. Give the contractor only the role and capabilities required for the task; do not share an administrator login.
- Keep revisions and activity history available. Confirm the actual content, user, settings, plugin/theme, and file events your WordPress version and installed tools record.
- Record the approved change. Keep the request, approval, target pages or components, planned window, and release decision in a separate work record.
- Check adjacent systems. Correlate WordPress events with hosting, file-transfer, identity, version-control, and deployment records.
- Protect and review the logs. Export or mirror them to a separately controlled destination where practical, and check important events promptly.
- Test coverage before depending on it. In staging, perform representative edits and account or plugin actions and verify which events appear, who can alter the logs, and whether timestamps and details are sufficient.
Choose monitoring by coverage, not promises
Before relying on an activity-log plugin or monitoring service, check these points against your site and workflow:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Does it cover the content editor, theme, plugins, settings, user roles, REST/API activity, and your deployment method?
- Does each relevant event identify the account, timestamp, affected object, source, and before-and-after values when appropriate?
- Can it alert promptly on privileged actions or unexpected changes?
- Can logs be exported, retained for the period you need, or copied outside the website’s administrative control?
- Can monitored users disable or delete the log?
- What compatibility, operational, privacy, storage, and cost implications apply?
Do not infer that a tool logs every possible action from a feature list. Confirm coverage in staging or in documentation for the exact product edition and integrations you use.
Protect evidence and set a review routine
Choose a review cadence appropriate to the site’s risk. Review high-impact alerts promptly and examine activity around releases and contractor offboarding. Decide how long evidence must be retained and who is responsible for reviewing it. Where practical, export or mirror logs to a separately controlled destination so one administrator cannot silently erase every copy.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
For federal web records, the U.S. National Archives and Records Administration says procedures should identify authorized creators, protect records from unauthorized addition, deletion, or alteration, and document site changes. Its guidance quotes ISO Technical Report 15489-2, section 7.2.4: “records systems should maintain audit trails or other elements sufficient to demonstrate that records were effectively protected from unauthorized alteration or destruction.” NARA web-records guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when you find an unexpected change
- Preserve evidence first. Save relevant log entries, timestamps, current content or files, and the approved baseline before making changes that could overwrite useful records.
- Compare against the approval. Identify precisely what differs in the content, files, settings, or deployment and whether the change falls within the approved task and window.
- Correlate the event. Review the associated account, role, source address, authentication history, neighboring events, scheduled updates, and automated processes.
- Ask for context through the agreed channel. An account attribution is a lead to investigate; it does not establish who was physically using the account or their intent.
- Contain credible risk. If the change is harmful or access may be compromised, restrict or revoke the relevant access, rotate potentially exposed credentials, and inspect related accounts and files.
- Recover and document. Restore from a known-good backup when appropriate. Record what evidence was preserved, what actions were taken, and what approval or monitoring changes should follow. Seek qualified incident-response help if the impact exceeds your ability to investigate safely.
Or skip the browser setup
For a quick visual record of a public page, make one GET request to ScreenshotNeo. Replace the URL with the page you want to capture and use your API key. The response is the image file; check the response headers for the page verdict and billing status.
ScreenshotNeo API documentation
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpCookie banners, supported consent banners, newsletter popups, and chat widgets are removed before the shot. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed. The MCP server gives AI agents screenshot tools, including take_screenshot, get_page_info, and capture_pdf. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000.
Sign up for 1,000 free screenshots a month, no card required.
Frequently Asked Questions
Does a log prove that a contractor made an unauthorized change?
No. It can link an event to an account, system, and time, but you need to investigate who used the account, whether the work was approved, and what surrounding records show.
Can a screenshot tell me who changed a page?
No. A screenshot can show a visible difference from a baseline, but attribution requires relevant CMS, hosting, identity, or deployment records.
Free tools Windows power users keep installed
One-click scans. No signup required.
Will a WordPress activity-log plugin record every change?
No universal coverage is established. It varies by plugin, edition, WordPress version, integrations, and the path used to make the change; verify it with documentation and staging tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
