How To Verify Activity Checkpoints With BetterShield Ultra?

2 min read

Send daily activity-log checkpoints to a webhook or syslog collector and compare a saved digest with the site's current log.

In BetterShield Ultra, ultra can send a daily checkpoint for each newly sealed activity-log day to a webhook or syslog collector, then compare your saved copy with the site’s current log.

Note: These controls require the paid BetterShield Ultra add-on alongside the free BetterShield plugin.

What it does

A checkpoint carries the UTC day, row count, digest and the digest it is chained to. It shows whether the site’s current rows differ from the external copy. It does not prevent a log change.

Step 1: Open Webhook (JSON)

Add or edit a Webhook (JSON) or Log collector (syslog) destination.

BetterShield Ultra Check the log against a checkpoint card with Day and Digest fields. — Comparison uses the checkpoint kept outside the site, not the seal stored on the site.

Step 2: Verify Activity With BetterShield Ultra Checkpoints

Turn on Send log checkpoints. It is off by default and is not available for Slack.
Save the destination and keep received checkpoints somewhere the site cannot reach.
Under Check the log against a checkpoint, enter Day in UTC and the 64-character Digest from your copy. Both fields start empty.
Select Compare.

Recommended settings

Our advice:

Use a destination controlled outside the WordPress hosting account.
Retain checkpoints for the same period as the audit evidence you need.
Compare the most recent checkpoint after an unexpected log reseal.

What it can break and how to undo

Checkpoint delivery adds a small daily message to the destination. Turn off Send log checkpoints and save to stop future copies.

A Differs result is not changed by comparing again. Investigate the reseal reason and earlier checkpoints.

Final Outcome

The destination reports a sent checkpoint after a day is sealed.

A current saved digest returns Matches.
A changed or older incompatible digest returns Differs with an explanation.

A connected assistant that can read Ultra’s settings can run the same comparison. Give it the day and the 64-character digest from your copy, and it returns whether they match the log on the site. It reads and compares only and changes nothing.

On multisite

Checkpoints belong to each site’s activity log, even when the network uses a shared activity table.

This is how you can verify activity checkpoints with BetterShield Ultra.

Getting Stuck? Feel free to contact our Dedicated Support Team.