# Settings screens

> Every PowerWP AI screen in wp-admin, and every setting on the Settings screen with its label, what it does and its default.

PowerWP AI adds one menu to wp-admin with ten screens. This page describes each screen and lists every setting on the **Settings** screen. All settings take effect when you save them.

## The screens

Open **PowerWP AI** in the wp-admin menu. Every screen has a header with the **AI on** or **AI off** switch, which pauses all AI access (see [AI access switch and read-only mode](/docs/safety/access-switch/)).

| Screen | What it is for |
|---|---|
| Dashboard | An overview: whether AI access is on, the last 24 hours (requests, tool calls, errors, denied calls, security events), the connections that are live, **Environment checks**, and **Quick actions** for maintenance mode, rescue mode, a new connection and a new backup. |
| Connections | Choose your AI app to get its setup steps, create connections (permissions, expiry, IP allow-list), and see, filter and revoke your connections. Your plan sets how many AI connections the site can have. Management keys are under **Advanced**. |
| Memory | The rules, facts and notes that reach every AI app. Proposals from AI apps wait here for your approval. Export and import copy the memory to another site. |
| Recipes | The ready-made procedures. Choose recipe packs, switch single recipes off, adapt one for this site or write your own with **New recipe**. |
| Activity | The activity log: every request, management action and security event. See [Activity log](/docs/safety/activity-log/). |
| Changes | The change log, with **Work sessions**, **All changes** and **Checkpoints**. See [Change log and undo](/docs/safety/undo/). |
| Backups | **Create backup** and **Restore from your computer**. See [Backups and restore](/docs/safety/backups/). |
| Settings | The settings below. |
| License | Your license key, plan, AI connections in use, sites, and the end of updates and support. **Check now**, **Use another key** and **Deactivate on this site** are here. Local sites need a key too (since 1.6.3). |
| Help | Setup steps for each AI app, troubleshooting, the connection details (address, key header, server name), the emergency stop and the security model. |

## Settings

The Settings screen has a side navigation with nine groups and two information sections. A changed field is marked **Modified**, and **Reset to default** appears next to it. A bar at the bottom saves your changes.

### General

| Setting | What it does | Default |
|---|---|---|
| AI access | Off refuses every AI app at once. The PowerWP AI screens keep working. | On |
| Read-only mode | Limits every connection to reading and diagnostics, whatever its permissions. | Off |
| Environment | Production, Staging or Development. It is shown to AI apps, and on production they are told to take extra care. | Production |
| Site label | A friendly name used in the setup steps for AI apps. Empty uses the domain. | Empty |

### Safety & rollback

| Setting | What it does | Default |
|---|---|---|
| Health check after risky changes | Loads the site after file, plugin, theme and key-setting changes to make sure it still works. | On |
| Revert changes that break the site | If the health check finds a fatal error after a change, the change is rolled back automatically. | On |
| Block PHP in uploads | Refuses to write PHP files into `wp-content/uploads`. | On |
| Hide passwords and keys in files | Masks passwords and keys in `wp-config.php` and `.env` files for connections without the Secrets permission. Options and database values are always masked for them. | On |
| Rollback window | Snapshots older than this are deleted. Their changes can then no longer be rolled back. | 30 days (1 to 365) |
| Snapshot storage cap | When the snapshots take more room, the oldest are deleted first. | 2,048 MB (64 to 102,400) |
| Largest automatic snapshot | Files, folders and tables above this size are not snapshotted automatically. | 256 MB (1 to 4,096) |

### Memory & recipes

| Setting | What it does | Default |
|---|---|---|
| Save proposals without my approval | Connections with the Settings permission save memory entries and recipes directly. The others still propose. Leave it off unless you trust every such connection, because a saved rule reaches every AI app that connects. | Off |

The recipe packs in use and the recipes you switch off are set on the **Recipes** screen, not here.

### Backups

| Setting | What it does | Default |
|---|---|---|
| Server copy lifetime | Backups that are never downloaded are deleted from the server after this time. | 48 hours (1 to 720) |
| Delete server copy after download | Removes the files from the server once a download has been confirmed. | On |
| Skip files larger than | Larger files are left out of backups and listed as skipped. | 512 MB (1 to 102,400) |
| Excluded paths | Paths relative to the WordPress root, one per line, that are left out of backups. | `wp-content/cache`, `wp-content/et-cache`, `wp-content/litespeed`, `wp-content/upgrade`, `wp-content/updraft`, `wp-content/ai1wm-backups`, `wp-content/backups-dup-lite`, `wp-content/backup-db`, `wp-content/uploads/backwpup`, `wp-content/uploads/wc-logs`, `wp-content/debug.log`, `node_modules`, `.git` |

### Alerts

| Setting | What it does | Default |
|---|---|---|
| Alert e-mail address | Where alerts go. At most one e-mail per event type every 10 minutes. Empty turns e-mail alerts off. | Empty |
| Send an alert when… | Choose from: a new connection is created; a new management key is created; an IP address is locked out after failed authentications; a token is used from a new IP address; a change is rolled back; a backup restore is started. | The first three |

### Activity log

| Setting | What it does | Default |
|---|---|---|
| Log retention | Older entries are deleted automatically. | 60 days (1 to 3,650) |
| Store response previews | Keeps a short, redacted preview of each tool result in the log. | On |

### Connection security

The defaults suit most sites.

| Setting | What it does | Default |
|---|---|---|
| Sign-in for AI apps | Lets apps such as Claude and ChatGPT connect with just your site's address: you sign in to WordPress and approve each app, no key needed. Off pauses the apps that signed in. Connections with a key keep working. | On |
| Require HTTPS | Refuses AI requests over plain HTTP so keys never travel unencrypted. Local development sites are exempt. | On |
| Trust X-Forwarded-Proto | Turn on only when your site runs behind a reverse proxy or load balancer that ends HTTPS. | Off |
| Client IP source | Used for IP allow-lists, lockouts and the log. Choose `REMOTE_ADDR`, `CF-Connecting-IP`, `X-Forwarded-For` or `X-Real-IP`. Pick a proxy header only if the site really is behind that proxy. | `REMOTE_ADDR` |
| Rate limit per key | Requests above the limit get HTTP 429. | 240 requests a minute (10 to 5,000) |
| Lockout threshold | Failed authentications from one IP address before it is locked out. | 10 (3 to 1,000) |
| Lockout duration | How long a locked-out IP address has to wait. | 15 minutes (1 to 1,440) |
| Strict MCP headers | Rejects requests whose MCP headers (`Mcp-Method`, `Mcp-Name`) are missing or do not match the request body. | On |

### File access

| Setting | What it does | Default |
|---|---|---|
| Extra allowed directories | File tools can reach the WordPress directory. Add other absolute paths only if needed, one per line. Paths that do not exist are dropped. | None |
| Maximum file read size | The largest amount of a file returned by one read. | 1,048,576 bytes (65,536 to 16,777,216) |

### Uninstall

| Setting | What it does | Default |
|---|---|---|
| Delete all data on uninstall | When the plugin is deleted, removes its data (connections, site memory and recipes, activity log, change history) and its private folder with snapshots and backups. | On |

If you switch it off, the data stays, but all connections are revoked when the plugin is deleted.

### Information sections

**Updates & privacy** describes what the daily update check sends to the PowerWP update service and when. It is information only. See [Data and privacy](/docs/security/data/).

**wp-config.php constants** shows whether `WPAI_MCP_DISABLED` and `WPAI_MCP_STORAGE_DIR` are set, and the current storage path. They can only be changed in `wp-config.php`. See [wp-config constants](/docs/reference/constants/).

## One more limit

The activity log keeps at most the newest 250,000 entries, besides the retention in days. This limit has no field on the Settings screen.

:::cards
- [wp-config constants](/docs/reference/constants/) — Switches that live in wp-config.php.
- [Permissions and presets](/docs/concepts/permissions/) — What each connection may do.
- [Keys and access control](/docs/security/access-control/) — Expiry, IP allow-lists and lockouts.
:::

Source: https://powerwp.ai/docs/reference/settings/