Using the Audit Log
What the Audit Log Shows
The Audit Log is a chronological record of every configuration change made to your service: origin server changes, IP allow and block list edits, URL path rules, protected pages, cache operations, traffic rules, settings updates, and certificate events.
Each entry records:
- Timestamp: when the change happened (UTC), with a link to a permanent page for that entry
- Change: what was changed, a category tag, and the specific values involved (for example, which countries were blocked or which origin host was set)
- Changed By: who or what made the change
You will find it in your dashboard under Audit Log.
Plan Availability
The Audit Log is available on the Advanced, Professional, Network, and Enterprise plans. Basic plan services see an upgrade prompt instead of the log.
Your full configuration history is retained with no time cutoff, so you can answer “when did this change?” even for changes made long ago.
Who Made a Change
The Changed By column distinguishes four sources:
- An email address: a member of your team made the change while signed into the dashboard
- API: the change came through the ExpeditedWAF API
- System: an automated process, such as a certificate renewal or a certificate change detection
- Support: our support team made the change on your behalf. These are changes made at your direction, usually from a conversation with you in a support ticket.
You can filter the log to any one of these sources.
What Is Not in the Audit Log
The Audit Log records changes to your service’s configuration. It does not record the protection updates we apply continuously across the whole Edge Network, including:
- IP reputation lists, which track addresses currently involved in attacks and abuse
- Geo IP data, which maps addresses to countries for your country blocking rules
- Intrusion and attack detection signatures, which recognize new exploits and attack techniques
These update many times a day for every service we protect, with no action needed from you, so they are not part of your change history.
Search and Filters
The filter bar at the top of the log supports:
- Search: matches the action name, the change details (an IP address, a country code, a path, an origin hostname), or the email of the person who made the change
- Category: narrow to one area, such as Cache, Traffic Rules, or Certificates
- Changed By: narrow to one person, the API, the system, or support
- Date range: pick a start and end date, or use the Today, 7 Days, 30 Days, and 90 Days presets. With no dates selected the log shows your full history.
Linking to a Specific Change
Click any entry’s timestamp to open a permanent page for that change. The link is stable and safe to paste into your team’s chat or an internal ticket. Anyone with dashboard access to the same service can open it.
If you contact us about a configuration question, including one of these links helps us find the exact change quickly.