WPIntell

Source evidence

Auto update and user doing the plug

Simple History – Track, Log, and Audit WordPress Changes · support · 2026-03-20T12:42:00+00:00

mixedsentiment
mediumseverity
0.85relevance
10replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 28 rows with source links

17.9% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

23 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
Imani resolved
Hello, can you tell me how the auto-plug works? This is for the free version. So the plug patch was set to auto update and there is a user connected to the update. How does it pick this user? If the user is deleted what user with Simple history uses to do the auto update. This topic was modified 2 months, 1 week ago by Imani . Doing more checking it looks like the user was connected to the user that did the install. How do I tell? After checking around it also appears with the free version if the user is removed the plug will error out. Either way, please review both of these post. Hi @ayesuwa , Simple History logs two separate events for auto-updates: “Enabled auto-updates for plugin X” — logged when someone clicks the auto-update toggle. This is attributed to the user who clicked it, which is likely what you’re seeing. “Updated plugin X” — the actual update, run by WordPress cron. This is attributed to “WordPress” , not any user. Could you check which of these events you’re looking at? When a user is deleted, their old log entries will show “Deleted user (had id 3, email jane@example.com , login jane)”. This is expected — the log is preserved, just noting the account no longer exists. It shouldn’t cause errors, and auto-updates will continue running normally. If you’re seeing an actual error message, could you share what it says? That would help me look into it. Hello, I am not seeing an actual error. nor do I see, – 1 or 2. I am trying to determine if this auto or user clicked. I do see this value in the log – plugin_update_type = user_enabled _message_key = plugin_bulk_updated Does that mean this was a cron, bulk update? Ah, that sounds like an auto-update run by WordPress cron, for a plugin that a user had previously enabled auto-updates on. To confirm: check the same event for these values: Initiator: If it says “WordPress” (or wp), it was the automatic cron update. If it says a username, it was a manual update. _wp_cron_running: If this is true, it was definitely run by WordPress cron, not by a user. Here is another thing I’d like to note: _user_login is equal to let’s say = jdoe _user_id is equal to lets say = 99889 _user_email is equal to lets say = jdoe@simplexxx.com _server_remote_addr is equal to lets say = 999.999.999.x With all these values populated, would this be the user the installed the software then cron run although the user didn’t hit click? @ayesuwa not sure, any change you could share a screenshot or the full context of the event? Event details Key Value id 999999 logger SimplePluginLogger level info date_local 20xx-03-xx 21:55:12 date_gmt 20xx-03-xx 02:55:12 message Updated plugin "Simple History" to 5.24.1 from 5.24.0 message_uninterpolated Updated plugin "{plugin_name}" to {plugin_version} from {plugin_prev_version} initiator wp_user occasions_id 90d04 subsequent_occasions_count 1 via Event context Key Value plugin_main_file_path simple-history/index.php plugin_slug simple-history plugin_name Simple History plugin_title <a href="https://simple-history.com">Simple History</a> plugin_description Plugin that logs various things that occur in WordPress and then presents those events in a very nice GUI. <cite>By <a href="https://simple-history.com/">Pär Thernström</a>.</cite> plugin_author <a href="https://simple-history.com/">Pär Thernström</a> plugin_version 5.24.1 plugin_url https://simple-history.com plugin_update_uri plugin_prev_version 5.24.0 plugin_update_type user_enabled _message_key plugin_bulk_updated _user_id 999xx _user_login mxxxxx _user_email mxxxxx@xxxxx.com _server_remote_addr xxx.xxx.xxx.x _server_http_referer https://www.xxxxx.com/ Thanks for sharing the details! Based on the event data, this looks like it was a manual update done by that user rather than an automatic update. The main clue is initiator: wp_user with the user’s info populated. Typically, if it were an automatic cron update, you’d see initiator: wp and _wp_cron_running: true instead, with no user info. The plugin_update_type: user_enabled part can be a bit confusing — it indicates that the plugin has auto-updates turned on, but doesn’t necessarily mean this specific update was automatic. So most likely the user info is there because that user performed the update themselves. Thank you! Thank you

Comments

10 shown
Imani 2026-03-20T13:59:00+00:00

Doing more checking it looks like the user was connected to the user that did the install. How do I tell? After checking around it also appears with the free version if the user is removed the plug will error out. Either way, please review both of these post.

Pär Thernström 2026-03-20T19:07:00+00:00

Hi @ayesuwa , Simple History logs two separate events for auto-updates: “Enabled auto-updates for plugin X” — logged when someone clicks the auto-update toggle. This is attributed to the user who clicked it, which is likely what you’re seeing. “Updated plugin X” — the actual update, run by WordPress cron. This is attributed to “WordPress” , not any user. Could you check which of these events you’re looking at? When a user is deleted, their old log entries will show “Deleted user (had id 3, email jane@example.com , login jane)”. This is expected — the log is preserved, just noting the account no longer exists. It shouldn’t cause errors, and auto-updates will continue running normally. If you’re seeing an actual error message, could you share what it says? That would help me look into it.

Imani 2026-03-20T21:28:00+00:00

Hello, I am not seeing an actual error. nor do I see, – 1 or 2. I am trying to determine if this auto or user clicked. I do see this value in the log – plugin_update_type = user_enabled _message_key = plugin_bulk_updated Does that mean this was a cron, bulk update?

Pär Thernström 2026-03-21T07:33:00+00:00

Ah, that sounds like an auto-update run by WordPress cron, for a plugin that a user had previously enabled auto-updates on. To confirm: check the same event for these values: Initiator: If it says “WordPress” (or wp), it was the automatic cron update. If it says a username, it was a manual update. _wp_cron_running: If this is true, it was definitely run by WordPress cron, not by a user.

Imani 2026-03-21T12:18:00+00:00

Here is another thing I’d like to note: _user_login is equal to let’s say = jdoe _user_id is equal to lets say = 99889 _user_email is equal to lets say = jdoe@simplexxx.com _server_remote_addr is equal to lets say = 999.999.999.x With all these values populated, would this be the user the installed the software then cron run although the user didn’t hit click?

Pär Thernström 2026-03-21T12:52:00+00:00

@ayesuwa not sure, any change you could share a screenshot or the full context of the event?

Imani 2026-03-21T20:25:00+00:00

Event details Key Value id 999999 logger SimplePluginLogger level info date_local 20xx-03-xx 21:55:12 date_gmt 20xx-03-xx 02:55:12 message Updated plugin "Simple History" to 5.24.1 from 5.24.0 message_uninterpolated Updated plugin "{plugin_name}" to {plugin_version} from {plugin_prev_version} initiator wp_user occasions_id 90d04 subsequent_occasions_count 1 via Event context Key Value plugin_main_file_path simple-history/index.php plugin_slug simple-history plugin_name Simple History plugin_title <a href="https://simple-history.com">Simple History</a> plugin_description Plugin that logs various things that occur in WordPress and then presents those events in a very nice GUI. <cite>By <a href="https://simple-history.com/">Pär Thernström</a>.</cite> plugin_author <a href="https://simple-history.com/">Pär Thernström</a> plugin_version 5.24.1 plugin_url https://simple-history.com plugin_update_uri plugin_prev_version 5.24.0 plugin_update_type user_enabled _message_key plugin_bulk_updated _user_id 999xx _user_login mxxxxx _user_email mxxxxx@xxxxx.com _server_remote_addr xxx.xxx.xxx.x _server_http_referer https://www.xxxxx.com/

Pär Thernström 2026-03-23T08:44:00+00:00

Thanks for sharing the details! Based on the event data, this looks like it was a manual update done by that user rather than an automatic update. The main clue is initiator: wp_user with the user’s info populated. Typically, if it were an automatic cron update, you’d see initiator: wp and _wp_cron_running: true instead, with no user info. The plugin_update_type: user_enabled part can be a bit confusing — it indicates that the plugin has auto-updates turned on, but doesn’t necessarily mean this specific update was automatic. So most likely the user info is there because that user performed the update themselves.

Imani 2026-03-26T11:57:00+00:00

Thank you!

Imani 2026-03-26T11:58:00+00:00

Thank you