Shibisty Sharing Activity Detector logs requests (page views, REST\/AJAX calls, admin-area hits, and optional heartbeat pings) into a dedicated database table, then groups them into sessions per user\/device. From that it computes, for each user:<\/p>\n\n
Total \u2212 Range<\/code>. A value greater than zero means two or more devices were active for the same user at the same time, which is the core signal this plugin is built to detect (e.g. a shared account being used from two locations at once).<\/li>\n<\/ul>\n\nSession boundaries are computed with a simple gap rule: if two consecutive requests from the same user\/device are \u2264 5 minutes apart, they belong to the same session and the time between them is counted; a gap of more than 5 minutes is treated as the user having left, and that gap is not<\/em> counted toward active time.<\/p>\n\nAdmin screens<\/h3>\n\n
All screens live under Suspicious Activity<\/strong> in the admin menu (manage_options<\/code> capability required):<\/p>\n\n\n- Activity<\/strong> (
wp-suspicious-activity<\/code>) \u2014 list of users with a suspicious-activity timeline, sortable\/filterable.<\/li>\n- Request Logs<\/strong> (
wp-sad-request-logs<\/code>) \u2014 full paginated log of every recorded request, with filters and sortable columns.<\/li>\n- Settings<\/strong> (
wp-sad-settings<\/code>) \u2014 logging rules and heartbeat.<\/li>\n- Log View<\/strong> (
wp-sad-log-view<\/code>, hidden) \u2014 detail view of a single log entry, linked from the Request Logs list.<\/li>\n- Activity View<\/strong> (
wp-sad-activity-view<\/code>, hidden) \u2014 detail view of a single user's activity\/timeline, linked from the Activity list.<\/li>\n<\/ul>\n\nFilter selections on the Activity and Request Logs screens are remembered in the browser (localStorage<\/code>) and restored on your next visit; the Reset button always clears them and returns to the default view. Wherever a user is identified from a session, their name links directly to their WordPress profile\/edit-user page.<\/p>\n\nSettings<\/h3>\n\n
Found under Suspicious Activity \u2192 Settings<\/strong>:<\/p>\n\n\n- Audience (who gets logged)<\/strong> \u2014 All users (including guests), Registered users only, or Admins only.<\/li>\n
- Logging scope (what gets logged)<\/strong> \u2014 all pages\/API\/admin area, only pages and heartbeat, only the site excluding admin area and heartbeat, only admin area and heartbeat, or stop logging entirely.<\/li>\n
- Logging window (when to log)<\/strong> \u2014 Always, or only during a specific time-of-day window (
from<\/code>\u2013to<\/code>). Windows that cross midnight (e.g. 22:00<\/code>\u201306:00<\/code>) are supported.<\/li>\n- Heartbeat<\/strong> \u2014 enable\/disable, plus a configurable ping interval (15\u2013600 seconds). When enabled, a small script pings the plugin's own REST endpoint (
\/wp-json\/wp-sad\/v1\/heartbeat<\/code>) at that interval for as long as the browser tab is open and visible, so active time is counted accurately even between page loads, without relying on admin-ajax.php<\/code>.<\/li>\n<\/ul>\n\nLocalization<\/h3>\n\n
The plugin's source strings are in English (shibisty-sharing-activity-detector<\/code> text domain, .pot<\/code> template included in \/languages<\/code>) and hand-written translations already exist for 30 additional languages — Ukrainian, Russian, German, French, Spanish, Italian, Portuguese (Brazil), Portuguese (Portugal), Polish, Dutch, Romanian, Czech, Hungarian, Bulgarian, Greek, Turkish, Swedish, Finnish, Lithuanian, Croatian, Serbian, Georgian, Azerbaijani, Kazakh, Belarusian, Arabic, Hebrew, Hindi, Chinese (Simplified), and Japanese. Like every WordPress.org-hosted plugin, translations are delivered through translate.wordpress.org and applied automatically based on each admin's own profile language \u2014 there's no plugin-specific language setting.<\/p>\n\nArchitecture<\/h3>\n\n
The plugin is split into logic and presentation layers rather than one monolithic file:<\/p>\n\n
`\n<\/code><\/pre>\n\nshibisty-sharing-activity-detector\/\n\u251c\u2500\u2500 shibisty-sharing-activity-detector.php # Bootstrap: constants, requires, activation\n\u251c\u2500\u2500 includes\/\n\u2502 \u251c\u2500\u2500 class-plugin.php # Orchestrator: hooks, wiring\n\u2502 \u251c\u2500\u2500 class-db.php # Table name\/schema, install + upgrade (dbDelta), checked on every init\n\u2502 \u251c\u2500\u2500 class-settings.php # Settings storage and sanitization\n\u2502 \u251c\u2500\u2500 class-request-logger.php # Classifies + gates + records each request\n\u2502 \u251c\u2500\u2500 class-heartbeat.php # REST heartbeat route + front-end pinger\n\u2502 \u251c\u2500\u2500 class-session-analyzer.php # Pure session\/timeline\/risk calculation logic\n\u2502 \u251c\u2500\u2500 class-view-helpers.php \/ class-query-helpers.php\n\u2502 \u251c\u2500\u2500 class-admin-menu.php # Menu registration, asset enqueueing\n\u2502 \u2514\u2500\u2500 admin\/ # Page controllers (Activity, Request Logs, Log View, Activity View, Settings)\n\u251c\u2500\u2500 views\/ # Plain PHP templates \u2014 no business logic or queries\n\u251c\u2500\u2500 assets\/ # css\/, js\/ (timeline UI, filter persistence, heartbeat pinger)\n\u2514\u2500\u2500 languages\/ # .pot template (translations delivered via translate.wordpress.org)\n `<\/p>\n\n
Request records carry a request_type<\/code> (page<\/code>, api<\/code>, admin<\/code>, or heartbeat<\/code>), set at write time, which the session analyzer uses to decide what counts as a genuine presence signal versus administrative\/system noise.<\/p>\n\n\n\n- Copy the
shibisty-sharing-activity-detector<\/code> folder into wp-content\/plugins\/<\/code>, or install it as a zip from the Plugins \u2192 Add New screen.<\/li>\n- Activate Shibisty Sharing Activity Detector<\/strong> from the WordPress admin Plugins screen.<\/li>\n
- The plugin creates its own table (
{$wpdb->prefix}request_logs<\/code>) automatically on activation, and also re-checks the table\/schema on every init<\/code> \u2014 so the table is repaired automatically if it's ever missing, without needing to reactivate the plugin.<\/li>\n- Visit Suspicious Activity \u2192 Settings<\/strong> to choose who gets logged, what gets logged, and whether heartbeat is enabled.<\/li>\n<\/ol>\n\n\n
\nDoes this plugin delete any data when deactivated or uninstalled?<\/h3><\/dt>\nNo. The plugin does not delete its data on deactivation, and uninstalling\/deleting the plugin does not currently remove the request_logs<\/code> table or its data either. Back it up or drop it manually if you need a clean removal.<\/p><\/dd>\nCan I add a language that isn't available yet?<\/h3><\/dt>\n