Where data is stored, who can do what, and what leaves your server.
This page covers where the plugin stores data, who is allowed to do what, and what leaves your server. Version 1.6.0 was primarily a security release, and the changes below are the substance of it.
| Data | Location |
|---|---|
| Module settings | WordPress options, one per module |
| Generated component CSS | wp-content/uploads/functionalities/components.css |
| Redirects, 404 log, task notes | A private folder with a randomly generated name under wp-content/functionalities/ |
Before 1.6.0 those JSON files sat at a fixed, guessable path. On any host that ignores .htaccess, which includes most nginx and Caddy setups, they were readable by URL. Your redirect map describes your site's entire URL history and task notes are a private working list, so both moved.
The folder name now carries 20 random characters, directory listing is blocked by an index file, and Apache and IIS rules are written alongside. Existing files migrate automatically on upgrade, whether or not the modules that created them are still switched on.
A Site Health check verifies this on your host, not in theory. It makes a real HTTP request to the folder and reports what actually happened. If your server ignores the bundled rules it tells you so, and tells you what to add to your server config. The random name is the protection that holds either way: the folder cannot be listed and its name never appears in front-end output.
Every WordPress 7 ability carries its own permission callback. Eight site-wide operations require manage_options. The ninth, check-content-integrity, uses edit_post for the specific post being checked and also verifies that the post type is one the module actually monitors.
Every ability's input schema sets additionalProperties to false. WordPress only rejects undeclared properties when that flag is false, so this is what stops a request smuggling in an extra field to reach a different permission path.
Header and footer code is sanitized when it is saved, against the capability of the author who saved it, and the result is recorded. It is not re-filtered on output.
Filtering at output time meant the check ran against the visitor's capability, so anonymous readers received mangled code: && became && and comparison operators were eaten as tags, while the logged-in administrator saw the snippet work perfectly. Any snippet containing a boolean operator was broken for everyone who was not an admin.
SVG sanitization requires a real SVG root element, restricts styles and local references, blocks external href values, and prefixes definition IDs so two icons on one page cannot collide. Font uploads are validated by binary magic-byte signature rather than file extension.
Nothing is phoned home and there is no telemetry. Two features make outbound requests, both under your control:
The diagnostics download deliberately excludes task content, redirects, users, secrets, and site URLs.
By default, uninstalling removes the generated CSS file and leaves your settings in place, so reinstalling restores everything. Tick Delete all plugin data when uninstalling on the dashboard first if you want options, post meta, transients, scheduled jobs, and data files removed as well.