About this plugin
AbilityGuard helps site administrators understand and audit what the WordPress Abilities API exposes on their site.
The WordPress Abilities API gives plugins, themes, AI tools, automation workflows, and other integrations a structured way to register and execute site capabilities. That is powerful, but it also creates a new visibility problem: administrators need to know which abilities are available, how those abilities are described, whether they are exposed through REST, and what executions have happened recently.
AbilityGuard adds that visibility layer. It inventories registered abilities, highlights risk-related annotations, and keeps a rolling execution log so you can review what ran, who triggered it, how it was triggered, and what data was stored.
What problem does AbilityGuard solve?
Without an inventory or audit trail, administrators may not know:
- Which abilities are registered by active plugins or integrations.
- Whether an ability is marked as read-only, destructive, or idempotent.
- Whether an ability is exposed through REST.
- Which abilities executed recently.
- Which user triggered an ability execution.
- Whether input or output payloads were captured for review.
AbilityGuard is designed to answer those questions from the WordPress admin area.
Features
AbilityGuard turns the WordPress Abilities API into a clear, auditable surface for site administrators. Instead of chasing capability registrations manually, you get a focused dashboard for visibility, risk review, and execution monitoring.
Core Visibility
- Ability Inventory: view all registered WordPress abilities in a single, searchable inventory.
- Risk Badges: instantly spot risk indicators derived from ability annotations.
- Annotation Visibility: inspect read-only, destructive, and idempotent metadata at a glance.
- Category & Namespace Details: see the official category, slug, and namespace used by each ability.
- REST Exposure & Schema Visibility: identify abilities exposed through REST and whether input/output schemas are registered.
- Current User Permission Check: confirm whether the current admin user can execute an ability with its default input.
Execution Monitoring
- Execution Log: review recent ability executions with a rolling audit trail.
- Log Details: inspect names, users, trigger context, status, and payload data for each event.
- Trigger Context: see whether an execution came from REST, WP-CLI, cron, or PHP.
- User Links: jump directly from a log entry to the related WordPress user profile when available.
Admin Controls & Privacy
- Configurable Payload Logging: choose whether to capture ability input and output data.
- Privacy-Conscious Defaults: output logging is disabled by default to reduce sensitive data exposure.
- Configurable Log Retention: keep as many execution entries as needed, including unlimited retention.
- Advanced Log Filters: narrow the activity view by status, context, risk, category, user ID, date range, or search term.
- CSV Export: export the current filtered log view for reporting or review.
- Saved Views: save common audit filters for fast reuse.
Operational Oversight
- Sensitive Watchlist: flag important abilities for closer monitoring.
- Email Alerts: receive notifications for high-risk, failed, or watched ability executions.
- Scheduled Reports: send daily or weekly activity summaries by email.
- Multisite Dashboard: review per-site ability and log counts from Network Admin.
- Uninstall Cleanup Option: optionally remove AbilityGuard data when the plugin is uninstalled.
What AbilityGuard does not log
AbilityGuard monitors Abilities API registrations and executions. It does not replace a general WordPress activity log plugin.
For example, AbilityGuard does not automatically log normal post edits, page updates, media uploads, settings saves, WooCommerce activity, or user profile changes unless those actions are performed through a registered WordPress ability.
Privacy and data storage
AbilityGuard stores logs in a custom database table in your WordPress database. Input logging can be enabled or disabled from the settings page. Output logging is available but disabled by default because ability responses may contain sensitive or large data.
Before enabling output logging, review your site’s privacy and compliance requirements.