Account Activity
Account Activity lists the sign-ins to your account and every change to how you sign in; it's where to look when you suspect somebody else is using your account. Open it from the Recent Activity section of the Password & Security page.
A row is kept for 90 days.
Recent Activity
The Recent Activity section on Password & Security summarizes the last 30 days:
- Sign-ins: how many, plus the time, location, and browser of the last one. Sign-ins from more than one country list the countries first; one from a country you've never been to is the clearest sign of a break-in. A badge after a country marks a VPN, a Tor exit node, or a datacenter; see A badge on a location.
- Security changes: the last change to how you sign in. A Review badge marks a change you should examine.
Each opens the full list, filtered to that part.
What a row tells you
Each row describes the event from your point of view, e.g. "Someone entered a wrong password", with the time, IP address, country, browser, and device.
The country comes from the IP address. A VPN, a mobile network, or a company network can show a country you're not in.
If you didn't make a change yourself, the row says who did, e.g. By the panel.
A badge on a location
Wherever the panel shows a location, a badge can follow it, saying what the network address is used for. No badge means an ordinary connection.
| Badge | Meaning |
|---|---|
| Tor exit node | The sign-in came through the Tor network. The location says nothing about the person. |
| VPN | A commercial VPN service. The location is the VPN's exit, not where the person is. |
| Hosting provider | A datacenter, not a home or office connection. |
| Private Relay | An iCloud Private Relay exit. Apple keeps the exit in your own country. |
A badge explains a country you've never been to; read it with the time and the browser.
A badge on its own isn't a problem; many people use a VPN at work or on a public network. But a sign-in you don't recognize from a Tor exit node or a datacenter is a strong sign of a break-in.
Each location gets one badge, the most important one: a Tor exit node is usually also a VPN and a datacenter, and three badges would say less than one.
The country is stored with the row at the time of the sign-in. The badge is read now, from a local database on the server, so it can appear or disappear later as the address changes its use.
What the page records
| Kind | Examples |
|---|---|
| Sign-ins | A sign-in, with the method: password, passkey, or password and a second step. A sign-out. A confirmation of your identity before a sensitive action. |
| Failed sign-ins | See Failed sign-ins. |
| Password | Changed or removed. |
| Passkeys | Added or removed. |
| Second steps | The authenticator app set up or removed. New backup codes. Trusted devices revoked. |
| Devices | A device added or removed, or starting or stopping to approve sign-ins. A sign-in you refused on a device. |
| Recovery | A setup link your hosting provider made, and its use. A request for help on the Can't sign in? page, and its answer. |
Show switches between all rows, Sign-ins only, and Security changes only.
Failed sign-ins
A failed sign-in is recorded when somebody enters your username with a wrong credential. The row says which step failed:
| The row says | Meaning |
|---|---|
| Someone entered a wrong password | The password was wrong. |
| A sign-in with a passkey failed | One of your passkeys didn't verify. |
| Someone entered your password and a wrong code | The password was correct. The authenticator app code or the backup code was wrong. |
| Someone entered your password, but the passkey did not verify | The password was correct. The passkey at the second step failed. |
| Someone entered your password, but the sign-in was not approved | The password was correct. Nobody approved the sign-in on a device. |
If that wasn't you, change your password now. Your second step stopped them this time.
One wrong password is usually a mistake; many rows from an address you don't know are an attack on your password. A passkey removes that risk, since there's no password to guess; see Go passwordless.
Not recorded:
- an attempt with a username that isn't yours;
- an attempt refused because there were too many in a short time;
- a form that never reached the password check, e.g. an expired page;
- a wrong password on the page that asks you to confirm your identity.
What else to know
Your hosting provider can read the activity of every account on the server, failed sign-ins included. Each row also goes to the server's system log.
Your hosting provider can sign in to the panel as you, to help you. The page doesn't show what such a session does.
The REST API returns the same rows with
GET /api/v1/auth-log?filter[subject]=account; the key needs the
identity:readonly or the email:readonly scope. The
MCP server returns them with the auth-log_list
tool and subject set to account. Failed sign-ins have the event type
login_failed.