Login Events Log
The Login Events Log is a read-only WHMCS Admin view for Extendy GeoShield login event metadata.
It helps administrators review how the addon recorded login activity, resolved context, evaluated alert decisions, and handled alert email status.
The log is an addon operational/security event log. It does not replace WHMCS core authentication logs, and it does not prove a visitor’s identity.
Access and location
The Login Events view appears in the Extendy GeoShield addon admin area.
The addon admin navigation currently includes:
- Login Events
- Settings
The Login Events page is read-only. It does not provide delete, resend email, trust-country, export, or client-facing actions.
Access is through the WHMCS Admin addon module area for administrators who can access the Extendy GeoShield addon page. The addon does not add a separate client-facing events log.
What the log records
The log displays stored event metadata from Extendy GeoShield login processing.
Visible columns currently include:
| Column | Meaning |
|---|---|
| Date/Time | Stored login event timestamp |
| Client | Client ID and safe client label when a Client Account context exists |
| User | WHMCS User ID |
| WHMCS User email snapshot captured from the login event | |
| IP Address | Resolved public client IP address when available |
| Country | GeoIP country name when available |
| Country Code | GeoIP country code when available |
| Provider | GeoIP provider stored on the event when available |
| Alert Mode | Alert mode stored on the event |
| Alert Sent | Whether Extendy GeoShield marked the alert email as sent |
| Decision | Alert decision result |
| Decision Reason | Safe explanation of the alert decision |
| IP Source Used | IP source/header actually used by the resolver |
| IP Source Verified | Whether the selected IP source/header was verified as acceptable to use |
| Alert Template | Email template selected for the event, when applicable |
| Alert Error | Safe email skip/failure reason, when applicable |
Rows without a safe Client Account context display No client context.
Filters
The Login Events page supports GET-based filters.
Current filters include:
- Client ID
- User ID
- User Email
- IP Address
- Country
- Country Code
- Provider
- Alert Mode
- Alert Sent: Any / Yes / No
- Decision
- Date From
- Date To
The Decision filter searches decision result and decision reason text.
The filters are intended for admin review and troubleshooting. They are not an export feature.
Pagination
The current page size is 50 login events.
Events are displayed newest first, ordered by stored event timestamp and event ID.
Invalid or negative page values are normalised safely.
Alert and email status
Logging an event does not mean an email was sent.
The Alert Sent column shows whether the addon marked the alert email as sent after WHMCS SendEmail returned success.
If sending is skipped or fails, Alert Sent remains Not sent and Alert Error may contain a safe reason, such as missing client context, missing Client Profile email, copied recipients configured on the template, or SendEmail failure.
Suppressed alert decisions are still useful log entries. They can show that a login was evaluated but did not require email because of trusted-country logic, Smart Mode known-country logic, country-detection failure settings, or cooldown.
IP and GeoIP context
The IP and country fields are diagnostic context.
They do not prove identity and do not guarantee that a visitor or IP address is safe.
IP Source Verified means the configured IP source/header was verified as acceptable to use. It does not mean the resolved IP address is trusted or non-malicious.
GeoIP country information depends on the resolved public IP address and the configured provider.
For provider behaviour, see GeoIP Providers Overview.
Timezone behaviour
The Login Events page displays the timestamp value stored by the addon for the event.
The current admin table does not apply a separate per-view timezone conversion layer.
Retention relationship
Login event rows may be removed by the configured Extendy GeoShield retention cleanup.
The current retention options are:
- 180 Days
- Disabled (Automatic Cleanup Off)
When retention is 180 days, WHMCS daily cron removes Extendy GeoShield login event records older than 180 days. Retention cleanup affects login event rows only; it does not remove known countries, trust tokens, settings, email templates, or unrelated WHMCS data.
This page intentionally does not duplicate a full Retention guide.
Sensitive data boundaries
The Login Events Log is designed for safe admin diagnostics.
It should not display:
- provider credentials;
- encrypted credential values;
- raw trust tokens;
- raw provider HTTP responses;
- request headers;
- cookies or sessions;
- database credentials;
- debug dumps.
The log may still include operational metadata such as user ID, Client ID, user email snapshot, IP address, country, provider, alert decision, and safe failure reason. Treat that metadata according to your organisation’s privacy and security policies.
For alert behaviour, see Email Alerts.