# Security model

> How PowerWP AI limits what an AI app can do: HTTPS, hashed keys, permissions, IP allow-lists, lockouts, switches, a change log and self-protection.

PowerWP AI gives an AI app a narrow, recorded way into your site. You decide what each connection may do, where it may connect from and for how long, and the plugin keeps a record of everything. This page lists the layers. [Keys and access control](/docs/security/access-control/) and [Data and privacy](/docs/security/data/) go into detail.

## Who can connect

- **HTTPS only.** Requests over plain HTTP are refused, so keys never travel unencrypted. Local development sites are exempt.
- **Keys are shown once and stored as hashes.** PowerWP AI keeps a one-way fingerprint, not the key itself.
- **Keys work on one entrance only.** A connection key is accepted on PowerWP AI's own endpoint, never on the rest of the WordPress REST API, admin-ajax.php or wp-admin.
- **Only administrators create connections.** AI apps can never manage connections or settings, so an app cannot give itself more access.
- **Sign-in for AI apps (1.6).** Apps that sign in receive short-lived tokens that act for one connection, and revoking the connection ends them at once. See [Sign-in for AI apps](/docs/concepts/sign-in/).

## What a connection may do

- **Nine permissions and four presets.** Reading is always allowed. Every family of write tools must be granted. See [Permissions and presets](/docs/concepts/permissions/).
- **Secrets are a separate permission.** Without it, passwords and keys in wp-config.php, options and database values are masked.
- **Read-only limits.** The Free plan and **Settings › General › Read-only mode** limit every connection to reading, whatever its permissions.
- **A connection acts as one administrator,** the one who created it. If that user is removed, the connection stops working.

## Where from, how long and how often

- **IP allow-lists** bind a connection to the addresses you list.
- **Expiry** ends a connection by itself. The form offers 7 days, 30 days, 90 days, 1 year or never.
- **Rate limits** cap requests per connection. The default is 240 a minute.
- **Lockouts** block an IP address for 15 minutes after 10 failed attempts. Both numbers can be changed.

## What happens to your site

- **Change log and snapshots.** Writes are recorded, with a snapshot where one is possible, so you can roll them back. See [Change log and undo](/docs/safety/undo/).
- **SQL guard.** `db_query` runs one read-only statement with a timeout. `db_execute` takes a snapshot of the affected rows first and refuses UPDATE or DELETE without WHERE unless the call asks for all rows explicitly. The guard reads every table a statement names, refuses SQL it cannot read, and refuses any statement that names PowerWP AI's own tables.
- **Health check and automatic revert.** After risky changes the site is loaded again, and a change that breaks it is reverted. See [Automatic health check](/docs/safety/auto-revert/).
- **Rescue mode.** If a plugin or theme crashes the site, AI requests from apps that connect with a key still work without them. See [Rescue mode](/docs/safety/rescue-mode/).
- **Backups on your computer.** Backups are downloaded to your computer, and the server copy is removed once the download is confirmed.

## Stopping and watching

- **AI access switch.** One switch refuses every AI app at once. See [AI access switch and read-only mode](/docs/safety/access-switch/).
- **Activity log.** Every request, tool call and security event is recorded with secrets redacted. No tool deletes log entries. Entries are removed only by the retention setting, 60 days by default. See [Activity log](/docs/safety/activity-log/).
- **E-mail alerts** can tell you about new connections, lockouts, new IP addresses, rollbacks and restores. Set them under **Settings › Alerts**.

## PowerWP AI protects itself

An AI app can never weaken PowerWP AI:

- Its settings can be changed only by an administrator in wp-admin. The option tools refuse them.
- Its own files are protected from file tools, and archives cannot be extracted into its folder.
- It cannot be deactivated, deleted or updated through MCP.
- Its database tables cannot be reached with SQL, and its own API cannot be called from MCP. That keeps the memory approval and the connection list out of an app's reach.
- Your license and your connections can be changed by an administrator, never by an AI app.

## Signed updates

Plugin updates come from the PowerWP update service, and WordPress installs one only when its signature matches the PowerWP release key built into the plugin. The service cannot act on your site.

## What permissions do not cover

Permissions are the main control. A connection with Files or Database writes can do a lot, so treat those like developer access, start with Read-only diagnostics and try big jobs on a copy of your site first. Some actions cannot be undone; see [What can't be undone](/docs/safety/limits/).

:::cards
- [Keys and access control](/docs/security/access-control/) — Keys, expiry, IP allow-lists, rate limits and lockouts.
- [Data and privacy](/docs/security/data/) — What stays on your site and what the update service receives.
- [How PowerWP AI keeps you safe](/docs/safety/) — Undo, checkpoints, rescue mode and backups.
:::

Source: https://powerwp.ai/docs/security/