• Administrative pages require granular OptiGraph capabilities.
• REST write operations include explicit permission_callback checks.
• Post SEO saves require both the WordPress post-edit capability and the plugin metadata capability.
• WordPress Abilities API operations provide permission callbacks independently of REST exposure.

All admin mutations use WordPress nonces and server-side capability checks.

• SQL values are parameterized; dynamic table names are derived only from $wpdb->prefix plus plugin-owned constants.
• Input is validated/sanitized by context.
• HTML output uses contextual escaping.
• Redirect status and match modes use allowlists.
• Regex rules are validated before persistence.

The AI provider uses wp_safe_remote_post(), requires HTTPS, validates the endpoint, disallows HTTP redirects and limits response size. AI generation is disabled by default; IndexNow automatic submission is separately opt-in.

AI credentials are stored in a separate non-autoloaded option. Sodium secretbox encryption is used when available with key material derived from the WordPress authentication secret. AES-256-GCM is the OpenSSL fallback. If neither encryptor is available, saving a key reports an error and preserves the existing value. Rotating authentication key material makes previously stored credentials unreadable; re-enter those credentials afterward.

External redirect targets are rejected by default. Developers may explicitly opt in through optigraph_seo_allow_external_redirect when a business requirement justifies it.

404 IP logging is disabled by default. If explicitly enabled, IP addresses are HMAC-hashed rather than stored in plaintext. 404 paths and referrers omit query strings. Retention is configurable in Settings and cleanup is scheduled daily. Hashed IPs remain pseudonymous data.

AI is disabled by default. Generation endpoints require a dedicated capability. Built-in AI generation returns suggestions; it does not automatically publish or mutate content.

Password-protected, unpublished and non-public post types are excluded from headless content exports. Discovery surfaces additionally respect site visibility, noindex and alternate canonicals. JSON-LD uses HTML-safe JSON encoding. Existing empty image alt attributes are preserved.

Audit and migration jobs carry a run ID and stable post-ID cursor. Atomic database-option locks serialize workers. Stale/duplicate jobs cannot advance a different run, and deactivation cancels both WP-Cron events and Action Scheduler jobs.