Logged.ai 1.2.1 — detailed feature, privacy and hosting reference

This file preserves the detailed reference text from the qualified 1.2.1 release.
The directory readme provides the shorter overview. Limits and safeguards below remain applicable.

Routine activity notification emails are supplied by the separately installed Pro add-on. On-site activity history, useful filters, CSV/JSON portability and critical security/failure notices remain Free. No data or notification consent is changed by upgrading.

Logged.ai records supported WordPress changes and minimized request findings in your WordPress database. Activity history, filtering, manual response, critical security and failure notices and exports work without a vendor account or subscription.
Role evidence distinguishes the acting user from the affected user and preserves the captured role difference. It uses local storage and no external AI or vendor account.

Supported collectors include existing site-role changes, user creation/deletion, selected profile/password changes, application-password creation/revocation, post changes and selected configuration/component changes. Sensitive profile/content/option values are redacted; supported differences and revision references are shown instead.

Request classification uses bounded local structural rules for seven documented families. Findings are observations, not proof of intent or successful exploitation. The WordPress sensor cannot see all static, cache or upstream traffic. Manual response supports approved configuration resources and bounded exact path, prefix, query-condition and exact-source policies with preview, explicit confirmation, GET/HEAD methods, finite expiry and recovery. Source policies require explicitly retained, trusted exact address context.

== Installation ==

1. Install and activate Logged.ai through Plugins > Add New > Upload Plugin, or install it from the WordPress plugin directory when available.
2. Open Logged.ai and review collection, retention and request-address settings for your site.
3. Inspect a supported change in Activity. Use the built-in request observation check to confirm what the WordPress sensor can see.
4. Configure optional email alerts or response policies only after reviewing their scope and recipients.

Requires WordPress 7.0 or newer, PHP 8.0 or newer, and MySQL or MariaDB with the standard WordPress database adapter. Use InnoDB for WordPress options and Logged.ai tables to support protected exports and privacy changes. Logged.ai does not convert existing tables automatically. SQLite, including the WordPress Playground database, is not supported: installation opens a paused diagnostics screen without creating Logged.ai tables or running its collectors. Switching to a supported database allows normal initialization.

WooCommerce is optional; its supported changes are recorded when WooCommerce is active. Keep WordPress scheduling running for background work and retention cleanup. Back up your database before replacing an existing installation. Replace plugin files without uninstalling to preserve data. If using Pro, install the matched Free and Pro packages; the add-on checks their edition compatibility.

== Export options and host requirements ==

Download now creates an authorized CSV or JSON download in memory, without saving a temporary export file or creating a background job. It supports up to 1,000 records and 2 MiB per download. The complete selected result must fit both limits: oversized selections are refused, never silently truncated. Narrow the UTC date filters and try again. This path does not depend on PHP Sodium, Unix permissions, private-directory configuration or WordPress cron; it has no operating-system restriction in the plugin. Standard WordPress/PHP execution and memory limits still apply. Safe final verification uses the standard WordPress MySQL/MariaDB connection, database locking, and InnoDB tables for activity and privacy state (the site WordPress options table, or the Logged.ai network privacy table). A legacy MyISAM options table cannot provide this locking protection; direct exports refuse safely while activity remains available. Ask the host to review the database configuration; Logged.ai does not convert tables automatically.

Prepare large export processes a saved, owner-authorized background job with safety limits of 1,000,000 rows and 256 MiB; these limits are not a host capacity or speed guarantee. Saved ciphertext expires after 24 hours and requires PHP Sodium. New chunks are encrypted in Logged.ai's database table, in bounded parts; no export or executable PHP file is generated. New saved exports do not require Unix filesystem permissions or writable upload directories. Background processing relies on WordPress scheduling and may be delayed. Keep the original WordPress authentication salts to read existing saved ciphertext.

Existing chunks from older packages remain readable and removable from the prior uploads/logged-ai/exports location or wp-content/.logged-ai-private (including a previously configured LOGGED_AI_PRIVATE_DIR). Those locations are used only for legacy reads and cleanup. Leave legacy storage accessible with its original owner-only permissions until its jobs expire and cleanup finishes. A resumed job can combine existing files and new encrypted database chunks with the same owner, scope and encryption checks. The plugin never includes or evaluates old export files.

The Exports page identifies missing background prerequisites without blocking Download now or activity logging. Existing background jobs remain listed; reading their encrypted files still requires the original compatible storage and encryption support. Personal-data export jobs continue to use the saved background mechanism and its requirements. Pro scheduled reports use separate encrypted database storage; reports and connected Pro features retain their own encryption and transport requirements. Small direct activity downloads do not replace or migrate those jobs. Network administrators use the separately authorized network export screen; ordinary site downloads never include another site's records.

Both paths apply current authorization, scope and privacy rules. A download is a plaintext CSV or JSON file: keep it secure on your device, because previously downloaded files cannot be recalled. Use HTTPS for administration and downloads.

== Request filters and JSON context exports ==

Requests can be filtered by inclusive UTC dates, source, finding family, HTTP method, exact status or status class, unknown status, Logged action and available source address or mask. Filters stay within the selected WordPress site and current retention. Use the WordPress site switcher to choose another authorized site. Older matching requests uses an exclusive evidence-ID cursor; new requests do not shift earlier pages. Applying or clearing filters returns to the newest selection. This is a read-only selection, not a new policy or a saved preference.

Blocked by Logged selects recorded local response issuance, not every HTTP 403. No Logged response and unconfirmed response remain separate. A full address filter requires full privacy mode and explicit sensitive-context permission. Masked address filters use IPv4 /24 or IPv6 /48; unavailable or expired exact context is excluded. A shared address does not identify a person. Dates in these filters are UTC; displayed evidence timestamps retain the selected display timezone.

Export selection and context downloads JSON schema 2: up to 500 matching minimized observations, 100 retained group summaries and 100 retained policy-history entries. It requires the export capability and a native WordPress nonce. Each category declares its cap and whether more matching records exist. With any filter or older-page cursor, groups and policy history are limited to references from the exported observations. Group counts and samples describe the whole UTC-minute group, not just matching observations. History dates may precede the selected observations. Without filters, the export includes recent retained site groups/history independently, including context whose shorter-lived observations have expired. These are independent bounded reads, not a transactionally complete snapshot or a full traffic log. No raw request input or policy target payload is added.

This request JSON download is separate from administrative activity CSV/JSON and from encrypted background exports. It uses memory without creating a saved file or job. Keep downloaded evidence secure; local copies cannot be recalled.

WP-CLI: wp logged-ai requests list or wp logged-ai requests export accepts --from=YYYY-MM-DD, --to=YYYY-MM-DD, --source=wordpress|server_log|synthetic_test, --family=FAMILY, --method=GET, --status=unknown|4xx|403, --response=blocked|none|unconfirmed, --identity=ADDRESS_OR_MASK, --before=EVIDENCE_ID and --limit=1..500. Use --url to select one native WordPress site; there is no all-sites export. The export default is 500 observations, list default 50. List keeps its observations key and adds continuation metadata. Export schema 2 adds groups, policy_history, filters, membership, limits and has_more. Invalid selections fail without silently widening the query. A selected --user must retain the required site grant. The existing trusted userless CLI path remains available but does not gain an exact-address grant.

== Privacy and coverage ==

Stores user/object IDs, approved role/status fields, UTC times and local request correlation IDs. Administrative collectors do not retain IPs, request queries, passwords or profile values. Request addresses default to masked direct peers. Full exact addresses require explicit selection; disabled mode removes address context. Forwarded headers are ignored by default and require an explicit trusted-proxy boundary. Untrusted or ambiguous source context cannot become an exact policy target. No IP pseudonyms are retained.

Default retention is 90 days for administrative events, 7 days for minimized requests, 30 days for groups/inactive response history and 14 days for explicitly selected exact addresses. These are configurable product defaults, not legal advice. Cleanup is bounded and may be delayed if cron is stopped; current privacy restrictions apply to display/export before physical cleanup finishes. Personal-data erasure removes associated site events and linked request addresses. Native WordPress public-link exports receive an authenticated-privacy-tool reference rather than duplicated audit facts. Previously downloaded files cannot be recalled.

Deactivation preserves data. Uninstall preserves data unless a separately confirmed installation-wide delete choice is enabled; that choice removes only Logged.ai owned data, settings, jobs and capabilities. Site administrators cannot erase another site's evidence.
Equivalent-authority PHP/database operators can alter local evidence. Direct SQL and activity while disabled are not observed.

People are represented by locally generated initials. Logged.ai does not request Gravatar or other external profile images. Local collection and inspection send no activity data to Logged.ai or an AI service. Optional email alerts use your WordPress mail service after you configure them; mail acceptance does not prove inbox delivery. Links to product information open an external website only when you follow them.

== When Pro helps ==

Free covers supported activity checks, critical security and failure notices and on-demand private exports. The optional Pro previews group shows Scheduled reports, Advanced alerts and Cases & handover as clearly labelled previews. Each includes an authentic plugin screenshot using fictional data, a read-only example and the Free/Pro difference. Contextual invitations open the matching example in place without submitting forms or creating a rule, schedule, connection or case. Screenshots and examples are bundled locally.

Pro actions match the installation: Get Pro opens published plans in a new tab; an installed inactive add-on opens ordinary WordPress plugin management; an active add-on awaiting its licence opens Licence & updates; earned local access opens the permitted real tool. Previewing never activates Pro. Opening a real tool does not enable its features automatically. Availability still depends on supported sources, host prerequisites and your permissions.

Settings includes a separate Pro tools overview and personal Hide suggestions / Hide Pro previews controls with restore actions. These display choices are saved locally on this WordPress site for the current administrator, separately from configuration forms. They do not change anyone else's preferences, retention, collection or sending settings. No external analytics requests are made. The existing sidebar lightning decoration uses only a site/user-scoped browser-tab flag to avoid repeating its subtle glint; reduced-motion preferences are respected.

Only explicitly choosing a purchase or activation action remembers the chosen workflow name in this browser with a seven-day continuation window, scoped to the current user and site. Expired shortcut metadata may remain until cleared or replaced. This optional browser convenience stores no filters, event identifiers, recipients or licence credentials and sends no task or site details in the pricing URL. The saved task can be cleared from the continuation prompt. After successful activation, the prompt offers the permitted tool; it does not save settings or start work. Browser storage restrictions can disable this convenience without preventing activation or normal tools.

== Translations ==

The Free interface and its shared application shell use WordPress translation APIs in PHP and JavaScript. The source catalog is included at languages/logged-ai.pot. Translations change display wording; stored evidence, UTC export fields, event codes, permissions and saved setting values keep their canonical format. This package does not include a human-reviewed translation into another language.

== PHP compatibility ==

Requires PHP 8.0 or newer. On PHP 8.0 and 8.1, Logged.ai disables exception argument capture for the current PHP request to keep passwords, keys and other secrets out of exception traces. Live debugging backtraces are unchanged. If the host prevents this setting, the plugin refuses activation or pauses its own loading and explains the required host setting. PHP 8.2 and newer retain native sensitive-parameter redaction.

== Opening affected content ==

Activity can show the current title and an Open content, Open product or Open order link for supported native events, only when your current WordPress permissions allow it. These links open in a new tab. Current titles can differ from the title at the time of the event; Logged.ai does not add them or article text to stored evidence or exports. A View revision link uses only the revision recorded for that event, when retained and accessible. Unavailable, restricted, deleted and trashed items do not receive a broken editor link. Unsupported item types retain their recorded identifier. This feature is included in Free and is also available with the Pro add-on.

== Item activity and recorded changes ==

View activity shortcuts open the current site's retained history for the selected object type and ID. Native editor shortcuts require both activity access and current item permissions. They do not read or store article text, save the editor, change collection, or provide a complete lifetime history. The HPOS order editor is supported; its order-list actions are unchanged.

Compact commerce summaries use only already-retained values. Money uses the recorded currency, never today's store currency. Unset prices are distinguished from zero; missing or redacted values stay explicit. Current item titles remain separate from historical evidence.

== Privacy and collection safeguards ==

Privacy changes and bounded activity/request cleanup use the same local coordination lock. A busy operation returns a retryable error. Unreadable saved privacy settings disable address capture and pause activity/request cleanup; review and save valid settings to repair them.

Observation-only response policies can record admitted matching GET/HEAD requests while the response switch is off or on. They do not deny requests or enable alerts. Active matching policies take priority when response is enabled. Existing exclusions, expiry, privacy settings and admission limits apply; observations are not a complete traffic count.

WooCommerce values retain supported exact stored precision independently of storefront display decimals. Native fractional stock and native scheduled-sale effective-price changes are captured. Custom data stores, unsupported numeric representations and changes made outside supported hooks can remain unavailable; no complete external-writer coverage is implied.

Private saved downloads verify their metadata and authenticated payload before output. Corrupt or changed export data is refused; recreate an unavailable export instead of treating a partial file as complete evidence.

== Workspace navigation and optional discovery ==

Everyday tools appear first in the sidebar. Setup and Settings are grouped under Manage. Pro previews offer three compact local examples before Explore Pro and More Plugins. The Show Pro previews switch applies only to your administrator account on this site; hiding the examples does not change logging or Pro functionality. The heading and switch remain available to restore the examples. Settings also provides Hide Pro previews and Restore Pro previews controls. Without JavaScript, visible preview links and the full Pro workflows page still work; changing the saved visibility preference requires JavaScript.

More Plugins is an optional page for administrators within the Logged.ai workspace. Its descriptions and publisher logos are bundled locally. Opening it makes no catalogue request, installs no plugin and sends no usage data. Publisher links open a new tab only when clicked; plugin availability and terms should be checked on the destination site. The Plugins.shop attribution is shown inside this plugin's admin workspace, never on the public website.

