When your website is maintained by multiple team members, external designers, marketing partners, or connected AI assistants (such as Cursor, Claude, or ChatGPT), the "Activity Log" allows you to track who modified which item, when, and through which channel.
The Activity Log helps you manage the following scenarios:
All activity logs are automatically generated by the system upon successful operation. They serve as an immutable audit log that cannot be manually modified or deleted by anyone, including the website owner.
You can view your website's activity log in two locations in the dashboard:
Go to the "Overview" page in the dashboard. The "Recent Activity" card in the middle of the page displays the latest 5 updates for your site:
Navigate to "Site Settings › Activity Log" in the left sidebar to browse the complete list of site activities from newest to oldest:
Whether in the "Overview" or "Site Settings › Activity Log," click any activity row to slide out a details panel that displays three main sections:
| Field | Display Content |
|---|---|
| Timestamp | Displays the full date and time based on the website's time zone (e.g., October 16, 2026, 10:30 PM). |
| Actor | Displays the actor's avatar and name. If the actor is a team member, their full login email address is displayed below to help distinguish members with the same name. |
| Category | Indicates the domain category of the event (Website, Content, Store, Orders, Marketing, Customers, Team, Settings). |
| Affected Item | Displays the type and name of the resource acted upon (e.g., "Blog Post · Spring New Arrivals Guide" or "Order · #1024"). If your role has permission to access that page, a "View" link is provided on the right, which opens the item in a new tab. |
This section lists the actual changes or statistics in plain language, for example:
Privacy and Credential Security: The Activity Log and change details never record plaintext passwords, payment or invoice API keys, Webhook signature keys, nor do they store plaintext personal data of buyers or visitors in the logs.
Helps you determine where the operation originated:
| Field | Description |
|---|---|
| Channel | Categorized as "Dashboard" (member logged in via browser), "AI Agent (MCP / API)" (executed via AI assistant or API), "Public Visitor" (visitor submitted a form or completed checkout on the live site), or "System Automation". |
| API Key | When an action is performed by an AI assistant (e.g., Cursor, Claude) or an external program via API, the key name (or authorized app name) and key prefix (e.g., knr_pat_a1b2c3d4) are displayed so you know exactly which key modified the site. |
| Source IP | Records the network IP address that initiated the request (for privacy, the source IP is visible only to the website's "Owner" and "Admins"). |
| Device & Browser | Automatically detects the browser and operating system used during the action (e.g., Chrome 130 · macOS, Safari 18 · iOS). |
System activities are organized into 8 categories that match the left sidebar menu:
| Category | Covered Activities |
|---|---|
| Website | Create website, first-time publish and republish, set to offline maintenance, schedule deletion and restore website, bind or unbind custom domain. |
| Content | Add/update/delete/duplicate pages, adjust page order, change homepage, update header/footer and page sections; add/update/publish/draft/delete blog posts; upload media files, replace with new version, move to trash, restore, permanently delete, and create external upload links. |
| Store | Add products, update product info and specs, archive/unarchive products, delete products. |
| Orders | Receive new orders, process refunds, schedule shipping and update fulfillment status, adjust digital product access, update internal order notes. |
| Marketing | Create/update/archive/delete forms, receive new form responses, restore or delete form responses from trash, download attachments and export CSV; create/update/schedule/cancel/send/abort/resume/duplicate/delete newsletter drafts; add/update/delete/start/stop promotions. |
| Customers | Add or update contacts, import and export contact lists, delete contacts, unsubscribe, add to or remove from suppression list; create/update/delete customer segments. |
| Team | Send and revoke team member invitations, member accepts invite to join team, modify member roles, remove members from team, transfer website ownership. |
Activity logs are fully integrated with —each member only sees activities they have permission to view:
Kanorio provides two levels of logs for "Site Team Operations" and "Personal Account Security":
| Comparison | Website Settings › Activity Log (This Article) | Account Settings › Recent Security Activity |
|---|---|---|
| View Location | Left sidebar "Website Settings › Activity Log" or Dashboard "Overview" | Bottom of "Account Settings › Login & Security" via top-right avatar |
| Scope | Changes to content, products, orders, marketing, settings, and team for a single website | Login history, 2FA toggles, regenerate backup codes, logged-in devices, linked Google accounts, and Passkey management for your personal account |
| Visibility | Team members of that website (filtered by role permissions) | Visible only to you |
To learn more about managing login devices and security activity for your personal account, please refer to .
No. To ensure transparency in collaboration and accountability for security audits, all activity logs are automatically written by the system and protected against tampering. No one, including the website owner, can modify or delete individual records.
When you or your team members use MCP (Connect AI Assistant) or API Keys to let tools like Cursor, Claude Code, or ChatGPT operate on your site, the system automatically marks them as an AI Agent. Open the details panel for that record to see the authorized application or API key (including the prefix and the name of the member who used the key) under "Source and Environment." If you notice unfamiliar key activity, please go to "Account Settings › API Access" to revoke the key immediately.
Modifying text, swapping images, or adjusting module styles in the visual editor is considered a draft change. The system does not generate an activity log for every keystroke. Records are written when you add/delete/duplicate pages, reorder pages, or click "Publish" to make the changes live.
If multiple people share the same email account to log in, the "Operator" in the activity log will appear as the same person, making it impossible to identify who performed an action if a mistake occurs. Please invite each partner to join using their own account via "Site Settings › Team" so that the activity log can accurately identify each member's name and email.
| Settings |
| Update general settings, SEO settings, tracking codes, cart and store settings, blog settings, media protection settings, payment and e-invoice settings, shipping and freight rules, business location and currency, automated email content and appearance, custom sender domain and sender name, add-on credits for email and storage, Webhook notification endpoints and key rotation. |