Skip to main content

​
Hardware Safeguards & Blocklists 🛡️

To ensure that AI-driven automation can never jeopardize the core availability, security, or integrity of your WordPress infrastructure, WooPilot AI enforces strict hardware-level execution boundaries.

​
🚫 Hardware Mutation Blocklist

Even if an AI model or bad actor attempts to request administrative changes, the WordPress REST dispatcher enforces an immutable, hardcoded blocklist:
Attempts to mutate any blocked route are immediately terminated with HTTP 403 Forbidden: Endpoint is blocked by hardware security policy.

​
🔍 Strict Read-Only SQL Validator (WooPilot_SQL_Validator)

All analytical queries dispatched to /read-sql pass through an in-memory SQL validator:
  • Whitelisted Keywords: Only SELECT statements are permitted.
  • Prohibited Keywords: Any presence of INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE, REPLACE, GRANT, REVOKE, or CREATE is rejected immediately.
  • Anti-Bypass Protection: String literal masking and SQL comment stripping (--, /*) prevent injection obfuscation.
  • Hardware Bounds: Every query automatically appends LIMIT 3000 and executes under SET SESSION MAX_EXECUTION_TIME = 3000 (3-second hard timeout).

​
🏛️ WordPress.org Standards & 57 Whitelisted Hooks

The connector plugin is engineered in full compliance with official WordPress.org Plugin Directory Guidelines:
  • Strict Hook Whitelist: The reactive automation engine is restricted to a closed list of 57 verified WooCommerce and WordPress lifecycle hooks (ALLOWED_HOOKS). Dynamic registration on unvetted arbitrary hooks is physically blocked.
  • Zero Raw SQL Mutations: 100% of store mutations are processed through in-memory rest_do_request() calls, firing all official WooCommerce data-integrity filters, tax calculations, stock deductions, and cache invalidation routines.
  • Plugin Check (PCP) Cleanliness: Zero PHP warnings or notices in production. Strictly scoped namespaces (WooPilot_*), capability checks (manage_woocommerce), and sanitization on all inputs.

​
🛡️ Zero Blast Radius (Fault Isolation)

WooPilot AI operates under a Zero Blast Radius principle:
  • Secondary operations (alerts, background scenario digests, scheduled tasks) are completely isolated in try...catch blocks.
  • Under no circumstances can a background automation or AI query interrupt critical store checkout, customer cart operations, or payment gateway webhooks.