> ## Documentation Index
> Fetch the complete documentation index at: https://docs.woopilot.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Hardware Safeguards & Blocklists

> Hardware-level protection boundaries, SQL query validators, and zero blast-radius fault isolation

# Hardware Safeguards & Blocklists 🛡️

To ensure that AI-driven automation can never jeopardize the core availability, security, or integrity of your WordPress infrastructure, WooPilot AI enforces **strict hardware-level execution boundaries**.

***

## 🚫 Hardware Mutation Blocklist

Even if an AI model or bad actor attempts to request administrative changes, the WordPress REST dispatcher enforces an immutable, hardcoded blocklist:

```text theme={null}
⛔ /wp/v2/users          ➔ Physically blocked (User & password protection)
⛔ /wp/v2/plugins        ➔ Physically blocked (Plugin install/delete protection)
⛔ /wp/v2/themes         ➔ Physically blocked (Theme modification protection)
⛔ /wp/v2/settings       ➔ Physically blocked (WordPress core settings)
⛔ /wc/v3/webhooks       ➔ Physically blocked (External webhook creation)
⛔ /wc/v3/system_status  ➔ Physically blocked (System status tools)
```

Attempts to mutate any blocked route are immediately terminated with `HTTP 403 Forbidden: Endpoint is blocked by hardware security policy`.

***

## 🔍 Strict Read-Only SQL Validator (`Hub_SQL_Validator`)

All analytical queries dispatched to `/read-sql` pass through an in-memory SQL validator:

* **Whitelisted Keywords:** Only `SELECT` statements are permitted.
* **Prohibited Keywords:** Any presence of `INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, `TRUNCATE`, `REPLACE`, `GRANT`, `REVOKE`, or `CREATE` is rejected immediately.
* **Anti-Bypass Protection:** String literal masking and SQL comment stripping (`--`, `/*`) prevent injection obfuscation.
* **Hardware Bounds:** Every query automatically appends `LIMIT 3000` and executes under `SET SESSION MAX_EXECUTION_TIME = 3000` (3-second hard timeout).

***

## 🛡️ Zero Blast Radius (Fault Isolation)

WooPilot AI operates under a **Zero Blast Radius** principle:

* Secondary operations (alerts, background scenario digests, scheduled tasks) are completely isolated in `try...catch` blocks.
* Under no circumstances can a background automation or AI query interrupt critical store checkout, customer cart operations, or payment gateway webhooks.


## Related topics

- [Introduction](/introduction.md)
- [Reactive Event Automations](/wooauto/reactive-events.md)