WordPress.org
Get WordPress

Plugin Directory

Changeset 3765287


Ignore:
Timestamp:
10/25/2026 10:09:03 PM (8 days ago)
Author:
ilyag
Message:

Listing: product description and banner

Location:
wingpilot
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • wingpilot/tags/1.6.0/readme.txt

    r3765224 r3765287  
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Connect WordPress to WPPilot — AI that reads your content, understands your business, and makes specific, reversible improvements through chat.
     11The AI site manager you'd hire if you could: it understands your WordPress site, answers your questions and makes improvements you approve.
    1212
    1313== Description ==
    1414
    15 WingPilot is the WordPress plugin half of [WPPilot](https://getwppilot.com), an AI site manager that actually knows your site.
    16 
    17 **On the two names:** **WingPilot** is this plugin — the name in the WordPress.org directory, the folder it installs to, and its text domain. **WPPilot** is the service it connects to, and the name you'll see in your wp-admin menu and at getwppilot.com. Everything below that says "WPPilot" is describing the service.
    18 
    19 WPPilot reads every page, post, and plugin on your site, builds a structured model of what your site is and who it's for, then writes you a Briefing — a magazine-quality assessment of what's working, what isn't, and where to start.
    20 
    21 **What WPPilot does once connected:**
    22 
    23 * **The Briefing** — A deep, editorial-quality analysis of your site delivered in the first 90 seconds. Not a checklist. Not a score. A real assessment written in clear language, with specific recommendations you can act on immediately.
    24 * **Conversational actions** — Ask WPPilot to rewrite a post title, improve an excerpt, update a meta description, fix typos in body content, or unpublish stale content. Every change shows you a preview first (current vs. proposed, with rationale), and every change can be rolled back with one click. Nothing happens without your approval.
    25 * **Multi-site cockpit** — Manage your WordPress sites from a single WPPilot account. The cockpit at app.getwppilot.com shows each site's status, recent findings, and Briefing insights at a glance. The Free and Starter plans include WPPilot's AI on one site; Pro and Agency include more.
    26 * **Watchtower monitoring** — WPPilot watches your site for security issues, content drift, and structural problems. Findings surface in the cockpit with severity indicators and timestamps. On the Free plan, Watchtower scans weekly; paid plans scan more often.
    27 * **Activity feed** — Every action WPPilot takes is logged with timestamps in the cockpit. Roll back any change. Full transparency, full reversibility.
    28 * **Safe by design** — The plugin changes your site only when you approve a change in WPPilot. It sends site data (content, metadata, plugin list) to the WPPilot service for analysis, and every change goes through preview → approve → execute, with a one-click undo. You approve every change individually.
    29 
    30 **What the plugin does locally:**
    31 
    32 The plugin registers your site's REST API endpoints so the WPPilot service can read content and, when you approve an action, write changes. It maintains the secure connection (per-site cryptographic secret + JWT authentication) and provides the settings page where you manage the connection.
    33 
    34 **What is free.** The Free plan connects one site, writes your Briefing, shows what needs attention, answers your questions about your site, and completes a limited number of real, approved improvements each month — no credit card required. Paid plans (Starter, Pro, Agency) add more usage and daily monitoring; Pro adds improvements WPPilot finds and prepares for you, and WooCommerce store insights. The plugin itself has no locked features: the limits are those of the WPPilot service, listed at [getwppilot.com/pricing](https://getwppilot.com/pricing).
    35 
    36 == External Services ==
    37 
    38 **This plugin requires a connection to the WPPilot service to function.** The plugin's core value (the Briefing, conversational actions, AI analysis, Watchtower monitoring) is provided by that external service. Without a connection, the plugin provides no standalone functionality other than displaying and receiving the lead forms already placed on your pages; messages sent through those forms stay on your site and are never sent to the WPPilot service.
    39 
    40 Below is every service this plugin, or a request it makes, communicates with, what is sent, and when.
    41 
    42 = 1. WPPilot service — api.getwppilot.com =
    43 
    44 Operated by WPPilot. Your site sends requests to it, and it reads from and (with your approval) writes to your site through the plugin's REST API (`/wp-json/wppilot/v1/`), authenticated by a per-site secret and a short-lived token.
    45 
    46 **What is sent:**
    47 
    48 * Site URL, WordPress and PHP versions, timezone, active plugins and themes with their versions and available updates.
    49 * Post and page content (titles, excerpts, body text, page-builder data, metadata, publish date and author display name), menus, theme styles, Site Health facts and scheduled-task names — when the service requests them, for example to build the Briefing or preview a change.
    50 * Where a piece of text you ask about appears on your site, when you use WPPilot's site-wide find: the posts, menus and widgets it appears in with a short surrounding snippet, and the names (never the values) of settings, theme settings and custom fields that contain it, with counts.
    51 * A list of your posts, pages or products of one type, when you ask about all of them: each item's title, status, dates, lengths of its text and SEO description (not the text itself), whether it has a featured image, its language and translation group, and for WooCommerce products the SKU, stock status and price. Order, coupon, subscription, form-entry and lead records are never listed.
    52 * Comments waiting for moderation, when you use comment moderation: each commenter's name and website URL, the domain of their email address (never the full address), the comment text, and the post it was left on. Commenters' IP addresses and browser details are not sent.
    53 * The HTML of one of your public pages, when the service asks for it because a CDN or firewall in front of your site turned its own request away — the plugin requests that page from your site as an anonymous visitor (no login, no cookies), so it is only what any visitor already receives.
    54 * Site activity events as they happen, so the service can show you an activity feed: logins (username and role), failed login attempts (the username or email address that was typed), user and role changes (username), new comments (the commenter's name) and comment moderation, plugin and theme changes, post edits, uploads, and changes to a few security-relevant settings such as the site address or the default user role (the setting's name only).
    55 * Security scanning data: a list of scannable files with their sizes, timestamps and fingerprints, and the contents of files that are new or have changed since the previous scan, so malware detection can run on the service (see "What is NOT sent" below).
    56 * Your WordPress admin email address, in the body of the request your site makes each time you click Connect, Finish connecting or Open WPPilot. WPPilot uses it only to propose your account address while no WPPilot account owns the site; you can change it before confirming. It is never put in a web address.
    57 
    58 **When data is sent:**
    59 
    60 * When you click Connect, Reconnect, Finish connecting or Open WPPilot in wp-admin.
    61 * While the WPPilot admin page is open (connection status, recent activity, Briefing summary).
    62 * Continuously, as activity events occur on your site while it is connected.
    63 * During periodic heartbeats and scheduled security scans (approximately daily).
    64 * When the WPPilot service requests content through the plugin's REST API.
    65 * When you approve a change in WPPilot (the service sends the change to the plugin's REST API).
    66 * When you delete the plugin: a one-time notice that the connection has ended.
    67 
    68 Terms of Use: [https://getwppilot.com/terms](https://getwppilot.com/terms) — Privacy Policy: [https://getwppilot.com/privacy](https://getwppilot.com/privacy)
    69 
    70 = 2. WPPilot web app — app.getwppilot.com =
    71 
    72 When you click Connect, Finish connecting or Open WPPilot, your browser opens the WPPilot app. The address carries your site's URL, a single-use sign-in token that expires after a few minutes, and the WPPilot page to open. Your site's server sends nothing to the app itself. Same Terms of Use and Privacy Policy as above.
    73 
    74 = 3. Image sources — Pexels and Openverse =
    75 
    76 When you approve a new page or post that WPPilot illustrated with a stock photograph, your site downloads that image from where it is hosted and adds it to your own media library, so your page does not depend on someone else's server. WPPilot chooses images from [Pexels](https://www.pexels.com) (hosted at images.pexels.com) and from [Openverse](https://openverse.org), a WordPress.org project that indexes openly licensed images hosted elsewhere (for example Flickr and Wikimedia Commons); the download goes to the host the image came from, over https only. The plugin accepts only https image addresses and keeps only image files, through WordPress's own media functions. Nothing about your site is sent other than what any image download reveals: your server's IP address and WordPress's standard user agent, which includes your site's address. Nothing is downloaded until you approve the content.
    77 
    78 * Pexels: [Terms](https://www.pexels.com/terms-of-service/) — [Privacy Policy](https://www.pexels.com/privacy-policy/)
    79 * Openverse: [Terms](https://docs.openverse.org/terms_of_service.html) — [Privacy Policy](https://wordpress.org/about/privacy/); each image's original host has its own terms, linked from the image's Openverse page.
    80 
    81 = 4. Your own site =
    82 
    83 Two features make requests to your own site, not to a third party: after a change, the plugin requests the changed page once to see whether a cache in front of your site still serves the old copy; and the public-page read described above fetches one of your published pages as an anonymous visitor.
    84 
    85 = What is NOT sent =
    86 
    87 File *contents* are transmitted only from the directories that hold distributed software — WordPress core, plugins, themes and must-use plugins — and only for code files. This is a property of where a file lives, not a guess about what is inside it, which is what makes it dependable.
    88 
    89 Everything else is inspected **on your server**, and only the finding is reported. That includes:
    90 
    91 * `wp-config.php` and any other configuration file — still checked for injected or malicious code, because that is exactly where such code hides; its contents are never sent, so your database credentials and WordPress security keys never leave your server.
    92 * `.htaccess`, `.user.ini` and similar server configuration.
    93 * Everything in your uploads directory.
    94 * Every data file — `.json`, `.xml`, `.txt` — wherever it lives, since these are where exported settings, service-account keys and pasted credentials collect.
    95 * Private keys, certificates and key stores; database dumps, SQL files and archives; `.env`, `.htpasswd` and similar credential stores. These are never read for content at all.
    96 
    97 For those files, what travels is a statement rather than the file: for example "this file contains two `eval()` calls, the first on line 14". No file content, no values, no credentials.
    98 
    99 Also never sent: WordPress user passwords or password hashes, commenters' full email and IP addresses, messages received through WPPilot forms or through Elementor forms (WPPilot reads only how many each Elementor form has kept, never what visitors wrote), and the contents of your database's options table.
    100 
    101 Files whose contents stay on your server are still fingerprinted, so if one is added or altered you are still told.
    102 
    103 **An honest limitation.** Within plugin and theme source code, which is transmitted, a developer who stored a credential directly in their own PHP file may have that line sent. WPPilot removes the ones it can recognise, but it cannot promise to recognise every name a developer might choose. Configuration files — where credentials actually belong, and where yours are — are covered by the boundary above rather than by that recognition.
    104 
    105 **A free account is required** at [app.getwppilot.com](https://app.getwppilot.com) to use this plugin. Accounts are created during the connect flow, proposing your WordPress admin email address, which you can change before confirming.
     15**The AI site manager you'd hire if you could.**
     16
     17WingPilot connects your WordPress site to WPPilot, an AI consultant that understands your site the way a senior expert would: its pages, products, plugins, design and the business behind it. Ask it anything, get answers grounded in what is actually on your site, and let it prepare improvements you approve with one click. No migration. No rebuild. No AI API keys.
     18
     19= Your site, understood =
     20
     21Connect your site and within about 90 seconds WPPilot writes your Briefing: what your site is for, who it serves, what is already working, and what needs attention first. Not a checklist, not a score. A real assessment in plain language, with the next steps spelled out.
     22
     23= Talk to your site =
     24
     25Ask a simple question or bring it a messy problem. "What should I improve first?" "Which of my plugins have known vulnerabilities?" "Why does this page not convert?" WPPilot investigates your live site, connects the dots across your content, plugins and settings, and answers with specifics, not generic AI advice. It remembers your conversations and decisions, so every answer builds on the last.
     26
     27= Improvements you approve =
     28
     29Tell WPPilot the outcome you want and it prepares the change: rewritten titles and descriptions, better page copy, new draft pages, fixed menus, cleaner SEO, alt text for your images and more. You see exactly what is there now, what it proposes and how Undo will put it back. Approve, refine or reject. Nothing changes until you say so, and every change can be undone.
     30
     31= Watchtower keeps watch =
     32
     33Watchtower checks your plugins against the latest vulnerability intelligence, verifies your files, watches what changes on your site and tells you what matters in language you can act on. A live activity feed shows every login, edit and change.
     34
     35= Know what your visitors do =
     36
     37Connect Google Analytics in the WPPilot app and it turns visitor behaviour into plain recommendations: which pages keep attention, where people leave and what to change.
     38
     39= One place for all your sites =
     40
     41The WPPilot cockpit shows every connected site, its latest Briefing and the work waiting for your review.
     42
     43= Start free =
     44
     45Free connects one site, writes your Briefing, answers your questions and completes your first real improvements, with no credit card. Starter, Pro and Agency add more work, more sites and proactive improvements WPPilot finds and prepares for you; see [getwppilot.com/pricing](https://getwppilot.com/pricing). The plugin itself has no locked features.
     46
     47== External services ==
     48
     49WingPilot needs a free WPPilot account and a connection to the WPPilot service at api.getwppilot.com, which provides the Briefing, the conversation, approved changes and Watchtower monitoring. Without a connection the plugin does nothing except keep WPPilot lead forms on your pages working (form messages stay on your site).
     50
     51Once you connect, your site shares with the service what it needs to do that work: your site address, WordPress, PHP, plugin and theme versions; the content WPPilot reads to answer you or prepare a change (pages, posts, products, menus, comments awaiting moderation, and a public page's HTML when your host blocks WPPilot's own request); site activity events such as logins and plugin changes; and security-scan file fingerprints and the contents of changed core, plugin and theme code files. Configuration files such as wp-config.php, uploads and data files are checked on your server and never sent. Your admin email is sent when you click Connect, to propose your account address. Approved changes are written back through the plugin's own REST API.
     52
     53Data is sent when you connect or open WPPilot, as activity happens on a connected site, during daily heartbeats and scans, when WPPilot reads content to answer you, and when you approve a change. When you approve a page illustrated with a stock photo, your site downloads that image (https only) from Pexels or the original Openverse host.
     54
     55Terms of Use: [getwppilot.com/terms](https://getwppilot.com/terms) · Privacy Policy: [getwppilot.com/privacy](https://getwppilot.com/privacy) · Pexels: [terms](https://www.pexels.com/terms-of-service/), [privacy](https://www.pexels.com/privacy-policy/) · Openverse: [terms](https://docs.openverse.org/terms_of_service.html), [privacy](https://wordpress.org/about/privacy/)
    10656
    10757== Installation ==
    … …  
    12474= What data does the plugin send? =
    12575
    126 Site metadata (URL, WordPress/PHP versions, plugin list, theme), content (titles, excerpts, body text) when requested by the service, comments awaiting moderation when you use that feature, activity events while your site is connected, and security scanning data. Your WordPress admin email is sent to WPPilot in the body of the request each time you click Connect or Open WPPilot, so it can be proposed as your account address while no account owns the site; it is never put in a web address. See the full External Services disclosure above.
    127 
    128 Security scanning still reads the files attackers actually modify — `wp-config.php` included, since skipping it would make for a poor security product. What it does not do is send them. Files outside WordPress core, plugin and theme code are inspected on your own server, and only the finding travels: "this file contains executable code it should not", never the file. Private keys, database dumps, archives and credential stores are not read for content at all. See the full External Services disclosure above.
     76Only what WPPilot needs to understand and improve your site, and only after you connect: site and version details, the content it reads to answer you, activity events and security-scan data. Configuration files such as wp-config.php are checked on your own server and never sent. See External services above and the [Privacy Policy](https://getwppilot.com/privacy).
    12977
    13078= Can WPPilot change things on my site? =

  • wingpilot/trunk/readme.txt

    r3765224 r3765287  
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Connect WordPress to WPPilot — AI that reads your content, understands your business, and makes specific, reversible improvements through chat.
     11The AI site manager you'd hire if you could: it understands your WordPress site, answers your questions and makes improvements you approve.
    1212
    1313== Description ==
    1414
    15 WingPilot is the WordPress plugin half of [WPPilot](https://getwppilot.com), an AI site manager that actually knows your site.
    16 
    17 **On the two names:** **WingPilot** is this plugin — the name in the WordPress.org directory, the folder it installs to, and its text domain. **WPPilot** is the service it connects to, and the name you'll see in your wp-admin menu and at getwppilot.com. Everything below that says "WPPilot" is describing the service.
    18 
    19 WPPilot reads every page, post, and plugin on your site, builds a structured model of what your site is and who it's for, then writes you a Briefing — a magazine-quality assessment of what's working, what isn't, and where to start.
    20 
    21 **What WPPilot does once connected:**
    22 
    23 * **The Briefing** — A deep, editorial-quality analysis of your site delivered in the first 90 seconds. Not a checklist. Not a score. A real assessment written in clear language, with specific recommendations you can act on immediately.
    24 * **Conversational actions** — Ask WPPilot to rewrite a post title, improve an excerpt, update a meta description, fix typos in body content, or unpublish stale content. Every change shows you a preview first (current vs. proposed, with rationale), and every change can be rolled back with one click. Nothing happens without your approval.
    25 * **Multi-site cockpit** — Manage your WordPress sites from a single WPPilot account. The cockpit at app.getwppilot.com shows each site's status, recent findings, and Briefing insights at a glance. The Free and Starter plans include WPPilot's AI on one site; Pro and Agency include more.
    26 * **Watchtower monitoring** — WPPilot watches your site for security issues, content drift, and structural problems. Findings surface in the cockpit with severity indicators and timestamps. On the Free plan, Watchtower scans weekly; paid plans scan more often.
    27 * **Activity feed** — Every action WPPilot takes is logged with timestamps in the cockpit. Roll back any change. Full transparency, full reversibility.
    28 * **Safe by design** — The plugin changes your site only when you approve a change in WPPilot. It sends site data (content, metadata, plugin list) to the WPPilot service for analysis, and every change goes through preview → approve → execute, with a one-click undo. You approve every change individually.
    29 
    30 **What the plugin does locally:**
    31 
    32 The plugin registers your site's REST API endpoints so the WPPilot service can read content and, when you approve an action, write changes. It maintains the secure connection (per-site cryptographic secret + JWT authentication) and provides the settings page where you manage the connection.
    33 
    34 **What is free.** The Free plan connects one site, writes your Briefing, shows what needs attention, answers your questions about your site, and completes a limited number of real, approved improvements each month — no credit card required. Paid plans (Starter, Pro, Agency) add more usage and daily monitoring; Pro adds improvements WPPilot finds and prepares for you, and WooCommerce store insights. The plugin itself has no locked features: the limits are those of the WPPilot service, listed at [getwppilot.com/pricing](https://getwppilot.com/pricing).
    35 
    36 == External Services ==
    37 
    38 **This plugin requires a connection to the WPPilot service to function.** The plugin's core value (the Briefing, conversational actions, AI analysis, Watchtower monitoring) is provided by that external service. Without a connection, the plugin provides no standalone functionality other than displaying and receiving the lead forms already placed on your pages; messages sent through those forms stay on your site and are never sent to the WPPilot service.
    39 
    40 Below is every service this plugin, or a request it makes, communicates with, what is sent, and when.
    41 
    42 = 1. WPPilot service — api.getwppilot.com =
    43 
    44 Operated by WPPilot. Your site sends requests to it, and it reads from and (with your approval) writes to your site through the plugin's REST API (`/wp-json/wppilot/v1/`), authenticated by a per-site secret and a short-lived token.
    45 
    46 **What is sent:**
    47 
    48 * Site URL, WordPress and PHP versions, timezone, active plugins and themes with their versions and available updates.
    49 * Post and page content (titles, excerpts, body text, page-builder data, metadata, publish date and author display name), menus, theme styles, Site Health facts and scheduled-task names — when the service requests them, for example to build the Briefing or preview a change.
    50 * Where a piece of text you ask about appears on your site, when you use WPPilot's site-wide find: the posts, menus and widgets it appears in with a short surrounding snippet, and the names (never the values) of settings, theme settings and custom fields that contain it, with counts.
    51 * A list of your posts, pages or products of one type, when you ask about all of them: each item's title, status, dates, lengths of its text and SEO description (not the text itself), whether it has a featured image, its language and translation group, and for WooCommerce products the SKU, stock status and price. Order, coupon, subscription, form-entry and lead records are never listed.
    52 * Comments waiting for moderation, when you use comment moderation: each commenter's name and website URL, the domain of their email address (never the full address), the comment text, and the post it was left on. Commenters' IP addresses and browser details are not sent.
    53 * The HTML of one of your public pages, when the service asks for it because a CDN or firewall in front of your site turned its own request away — the plugin requests that page from your site as an anonymous visitor (no login, no cookies), so it is only what any visitor already receives.
    54 * Site activity events as they happen, so the service can show you an activity feed: logins (username and role), failed login attempts (the username or email address that was typed), user and role changes (username), new comments (the commenter's name) and comment moderation, plugin and theme changes, post edits, uploads, and changes to a few security-relevant settings such as the site address or the default user role (the setting's name only).
    55 * Security scanning data: a list of scannable files with their sizes, timestamps and fingerprints, and the contents of files that are new or have changed since the previous scan, so malware detection can run on the service (see "What is NOT sent" below).
    56 * Your WordPress admin email address, in the body of the request your site makes each time you click Connect, Finish connecting or Open WPPilot. WPPilot uses it only to propose your account address while no WPPilot account owns the site; you can change it before confirming. It is never put in a web address.
    57 
    58 **When data is sent:**
    59 
    60 * When you click Connect, Reconnect, Finish connecting or Open WPPilot in wp-admin.
    61 * While the WPPilot admin page is open (connection status, recent activity, Briefing summary).
    62 * Continuously, as activity events occur on your site while it is connected.
    63 * During periodic heartbeats and scheduled security scans (approximately daily).
    64 * When the WPPilot service requests content through the plugin's REST API.
    65 * When you approve a change in WPPilot (the service sends the change to the plugin's REST API).
    66 * When you delete the plugin: a one-time notice that the connection has ended.
    67 
    68 Terms of Use: [https://getwppilot.com/terms](https://getwppilot.com/terms) — Privacy Policy: [https://getwppilot.com/privacy](https://getwppilot.com/privacy)
    69 
    70 = 2. WPPilot web app — app.getwppilot.com =
    71 
    72 When you click Connect, Finish connecting or Open WPPilot, your browser opens the WPPilot app. The address carries your site's URL, a single-use sign-in token that expires after a few minutes, and the WPPilot page to open. Your site's server sends nothing to the app itself. Same Terms of Use and Privacy Policy as above.
    73 
    74 = 3. Image sources — Pexels and Openverse =
    75 
    76 When you approve a new page or post that WPPilot illustrated with a stock photograph, your site downloads that image from where it is hosted and adds it to your own media library, so your page does not depend on someone else's server. WPPilot chooses images from [Pexels](https://www.pexels.com) (hosted at images.pexels.com) and from [Openverse](https://openverse.org), a WordPress.org project that indexes openly licensed images hosted elsewhere (for example Flickr and Wikimedia Commons); the download goes to the host the image came from, over https only. The plugin accepts only https image addresses and keeps only image files, through WordPress's own media functions. Nothing about your site is sent other than what any image download reveals: your server's IP address and WordPress's standard user agent, which includes your site's address. Nothing is downloaded until you approve the content.
    77 
    78 * Pexels: [Terms](https://www.pexels.com/terms-of-service/) — [Privacy Policy](https://www.pexels.com/privacy-policy/)
    79 * Openverse: [Terms](https://docs.openverse.org/terms_of_service.html) — [Privacy Policy](https://wordpress.org/about/privacy/); each image's original host has its own terms, linked from the image's Openverse page.
    80 
    81 = 4. Your own site =
    82 
    83 Two features make requests to your own site, not to a third party: after a change, the plugin requests the changed page once to see whether a cache in front of your site still serves the old copy; and the public-page read described above fetches one of your published pages as an anonymous visitor.
    84 
    85 = What is NOT sent =
    86 
    87 File *contents* are transmitted only from the directories that hold distributed software — WordPress core, plugins, themes and must-use plugins — and only for code files. This is a property of where a file lives, not a guess about what is inside it, which is what makes it dependable.
    88 
    89 Everything else is inspected **on your server**, and only the finding is reported. That includes:
    90 
    91 * `wp-config.php` and any other configuration file — still checked for injected or malicious code, because that is exactly where such code hides; its contents are never sent, so your database credentials and WordPress security keys never leave your server.
    92 * `.htaccess`, `.user.ini` and similar server configuration.
    93 * Everything in your uploads directory.
    94 * Every data file — `.json`, `.xml`, `.txt` — wherever it lives, since these are where exported settings, service-account keys and pasted credentials collect.
    95 * Private keys, certificates and key stores; database dumps, SQL files and archives; `.env`, `.htpasswd` and similar credential stores. These are never read for content at all.
    96 
    97 For those files, what travels is a statement rather than the file: for example "this file contains two `eval()` calls, the first on line 14". No file content, no values, no credentials.
    98 
    99 Also never sent: WordPress user passwords or password hashes, commenters' full email and IP addresses, messages received through WPPilot forms or through Elementor forms (WPPilot reads only how many each Elementor form has kept, never what visitors wrote), and the contents of your database's options table.
    100 
    101 Files whose contents stay on your server are still fingerprinted, so if one is added or altered you are still told.
    102 
    103 **An honest limitation.** Within plugin and theme source code, which is transmitted, a developer who stored a credential directly in their own PHP file may have that line sent. WPPilot removes the ones it can recognise, but it cannot promise to recognise every name a developer might choose. Configuration files — where credentials actually belong, and where yours are — are covered by the boundary above rather than by that recognition.
    104 
    105 **A free account is required** at [app.getwppilot.com](https://app.getwppilot.com) to use this plugin. Accounts are created during the connect flow, proposing your WordPress admin email address, which you can change before confirming.
     15**The AI site manager you'd hire if you could.**
     16
     17WingPilot connects your WordPress site to WPPilot, an AI consultant that understands your site the way a senior expert would: its pages, products, plugins, design and the business behind it. Ask it anything, get answers grounded in what is actually on your site, and let it prepare improvements you approve with one click. No migration. No rebuild. No AI API keys.
     18
     19= Your site, understood =
     20
     21Connect your site and within about 90 seconds WPPilot writes your Briefing: what your site is for, who it serves, what is already working, and what needs attention first. Not a checklist, not a score. A real assessment in plain language, with the next steps spelled out.
     22
     23= Talk to your site =
     24
     25Ask a simple question or bring it a messy problem. "What should I improve first?" "Which of my plugins have known vulnerabilities?" "Why does this page not convert?" WPPilot investigates your live site, connects the dots across your content, plugins and settings, and answers with specifics, not generic AI advice. It remembers your conversations and decisions, so every answer builds on the last.
     26
     27= Improvements you approve =
     28
     29Tell WPPilot the outcome you want and it prepares the change: rewritten titles and descriptions, better page copy, new draft pages, fixed menus, cleaner SEO, alt text for your images and more. You see exactly what is there now, what it proposes and how Undo will put it back. Approve, refine or reject. Nothing changes until you say so, and every change can be undone.
     30
     31= Watchtower keeps watch =
     32
     33Watchtower checks your plugins against the latest vulnerability intelligence, verifies your files, watches what changes on your site and tells you what matters in language you can act on. A live activity feed shows every login, edit and change.
     34
     35= Know what your visitors do =
     36
     37Connect Google Analytics in the WPPilot app and it turns visitor behaviour into plain recommendations: which pages keep attention, where people leave and what to change.
     38
     39= One place for all your sites =
     40
     41The WPPilot cockpit shows every connected site, its latest Briefing and the work waiting for your review.
     42
     43= Start free =
     44
     45Free connects one site, writes your Briefing, answers your questions and completes your first real improvements, with no credit card. Starter, Pro and Agency add more work, more sites and proactive improvements WPPilot finds and prepares for you; see [getwppilot.com/pricing](https://getwppilot.com/pricing). The plugin itself has no locked features.
     46
     47== External services ==
     48
     49WingPilot needs a free WPPilot account and a connection to the WPPilot service at api.getwppilot.com, which provides the Briefing, the conversation, approved changes and Watchtower monitoring. Without a connection the plugin does nothing except keep WPPilot lead forms on your pages working (form messages stay on your site).
     50
     51Once you connect, your site shares with the service what it needs to do that work: your site address, WordPress, PHP, plugin and theme versions; the content WPPilot reads to answer you or prepare a change (pages, posts, products, menus, comments awaiting moderation, and a public page's HTML when your host blocks WPPilot's own request); site activity events such as logins and plugin changes; and security-scan file fingerprints and the contents of changed core, plugin and theme code files. Configuration files such as wp-config.php, uploads and data files are checked on your server and never sent. Your admin email is sent when you click Connect, to propose your account address. Approved changes are written back through the plugin's own REST API.
     52
     53Data is sent when you connect or open WPPilot, as activity happens on a connected site, during daily heartbeats and scans, when WPPilot reads content to answer you, and when you approve a change. When you approve a page illustrated with a stock photo, your site downloads that image (https only) from Pexels or the original Openverse host.
     54
     55Terms of Use: [getwppilot.com/terms](https://getwppilot.com/terms) · Privacy Policy: [getwppilot.com/privacy](https://getwppilot.com/privacy) · Pexels: [terms](https://www.pexels.com/terms-of-service/), [privacy](https://www.pexels.com/privacy-policy/) · Openverse: [terms](https://docs.openverse.org/terms_of_service.html), [privacy](https://wordpress.org/about/privacy/)
    10656
    10757== Installation ==
    … …  
    12474= What data does the plugin send? =
    12575
    126 Site metadata (URL, WordPress/PHP versions, plugin list, theme), content (titles, excerpts, body text) when requested by the service, comments awaiting moderation when you use that feature, activity events while your site is connected, and security scanning data. Your WordPress admin email is sent to WPPilot in the body of the request each time you click Connect or Open WPPilot, so it can be proposed as your account address while no account owns the site; it is never put in a web address. See the full External Services disclosure above.
    127 
    128 Security scanning still reads the files attackers actually modify — `wp-config.php` included, since skipping it would make for a poor security product. What it does not do is send them. Files outside WordPress core, plugin and theme code are inspected on your own server, and only the finding travels: "this file contains executable code it should not", never the file. Private keys, database dumps, archives and credential stores are not read for content at all. See the full External Services disclosure above.
     76Only what WPPilot needs to understand and improve your site, and only after you connect: site and version details, the content it reads to answer you, activity events and security-scan data. Configuration files such as wp-config.php are checked on your own server and never sent. See External services above and the [Privacy Policy](https://getwppilot.com/privacy).
    12977
    13078= Can WPPilot change things on my site? =
Note: See TracChangeset for help on using the changeset viewer.