Security & Privacy Configuration

The wordpress plugin is currently in closed beta. Please check back later for updates.

Required Fields

The following fields are required for every log entry sent to Agent Analytics:

Field	Format	Max Length	Description
`timestamp`	ISO 8601	-	UTC timestamp of the request
`method`	String	10 chars	HTTP method (GET, POST, etc.)
`host`	String	255 chars	Request hostname
`path`	String	2048 chars	URL path (without query string)
`status_code`	Integer	100-599	HTTP response status code
`ip`	String	45 chars	Client IP address (supports IPv4/IPv6)
`user_agent`	String	1024 chars	User agent string

All required fields must be present for successful log ingestion. Missing fields will result in validation errors on the API side.

Optional Fields

These fields are included when available but not required:

Field	Format	Max Length	Description
`query_params`	Object	100 keys	Query string parameters (after redaction)
`referer`	String	2048 chars	HTTP referer header
`bytes_sent`	Integer	-	Response size in bytes
`duration_ms`	Integer	-	Request processing time

Automatic Path Filtering

Always Excluded Paths

The following paths are automatically excluded from logging and cannot be overridden:

wp-admin         # All admin pages and subdirectories
wp-login.php     # Login page
wp-cron.php      # Cron jobs
admin-ajax.php   # Admin AJAX calls
xmlrpc.php       # XML-RPC interface
wp-json/wp/*     # WordPress core REST API

These exclusions use substring matching, so they work regardless of WordPress installation directory (e.g., /blog/wp-admin/ is also excluded).

Request Type Exclusions

The plugin automatically skips:

Admin-referred requests: Any request with a referer containing wp-admin
REST API calls: Requests with rest_route=/wp/* query parameter
CLI operations: WP-CLI commands
Edit context: REST requests with context=edit parameter

Query Parameter Redaction

Default Redacted Parameters

The following query parameter keys are automatically redacted (replaced with [REDACTED]):

password    # Password fields
pass        # Alternative password fields
token       # Authentication tokens
secret      # Secret keys
card        # Credit card fields
cc          # Credit card abbreviation
ssn         # Social security numbers

Redaction uses substring matching. Any parameter containing these strings will be redacted (e.g., user_password, api_token, card_number).

Redaction Example

Original query string:

?username=john&password=secret123&product=widget&api_token=abc123

After redaction:

{
  "username": "john",
  "password": "[REDACTED]",
  "product": "widget",
  "api_token": "[REDACTED]"
}

Configuration Options

General Settings

Setting	Default	Description
Enable Logging	Off	Master switch for log collection
API Endpoint	`https://artemis.api.tryprofound.com/v1/logs/wordpress`	Destination for logs
Batch Size	500	Number of logs per send (50-1000)
Send Interval	60 seconds	How often to process queue (30-600 seconds)

Privacy Settings

Setting	Default	Options	Description
Skip Admin	On	On/Off	Exclude `/wp-admin/` requests
Skip Cron	On	On/Off	Exclude cron job requests
Skip AJAX	On	On/Off	Exclude admin AJAX calls
Skip REST	Off	On/Off	Exclude ALL REST API requests (not just core)
Redact Query Keys	`password,pass,token,secret,card,cc,ssn`	Comma-separated list	Parameters to redact

Advanced Settings

Setting	Default	Description
Custom Deny Paths	Empty	Newline-separated path patterns (supports wildcards)
Max Queue Size	100,000	Maximum logs to store before dropping old entries
Retention Days	7	Days to keep unsent logs
Circuit Breaker Threshold	3	Consecutive failures before pausing
Circuit Breaker Cooldown	30 minutes	Pause duration after threshold reached

API Key Security

Storage Methods

The plugin supports three methods for API key configuration, in order of security preference:

Environment Variable (Most Secure)
WordPress Constant
Database (Encrypted)

Add to your server environment:

WP_ENV_AGENT_ANALYTICS_API_KEY=bot_your_key_here

Or in wp-config.php:

define('WP_ENV_AGENT_ANALYTICS_API_KEY', 'bot_your_key_here');

For production environments, use environment variables or constants. Database storage should only be used for testing or when file access is restricted.

Custom Path Filtering

Wildcard Pattern Examples

Add custom path exclusions using these patterns:

/private/*           # Exclude all paths starting with /private/
*/temp/*            # Exclude paths containing /temp/
*.pdf               # Exclude all PDF files
/api/v1/internal/*  # Exclude internal API endpoints
staging.*           # Exclude staging subdomains

Path Filtering Priority

Paths are evaluated in this order:

Built-in exclusions (wp-admin, wp-login.php, etc.)
Custom deny paths (user-configured patterns)
Referer check (requests from wp-admin)
REST API check (WordPress core API)

First match wins - if any check matches, the request is excluded.

IP Address Handling

Detection Order

The plugin attempts to detect the real client IP in this order:

HTTP_X_FORWARDED_FOR - First IP in the list (for proxies/load balancers)
HTTP_CF_CONNECTING_IP - Cloudflare’s real IP header
HTTP_X_REAL_IP - Alternative proxy header
HTTP_TRUE_CLIENT_IP - Cloudflare Enterprise header
REMOTE_ADDR - Direct connection (fallback)

The plugin automatically handles reverse proxies used by managed WordPress hosts (WP Engine, Kinsta, etc.) and CDNs (Cloudflare, Fastly).

IP Privacy Considerations

No anonymization: Full IP addresses are captured for accurate bot detection
Required for service: IP data is essential for geographic analysis and reverse DNS lookups
GDPR compliance: Consider your legal requirements for IP data collection

Data Retention

Plugin-Side Retention

Queue entries: Deleted after successful send
Failed entries: Retried up to 6 times with exponential backoff
Old entries: Auto-cleaned after retention period (default 7 days)
Maximum queue: Oldest entries dropped when limit reached (100,000)

API-Side Processing

Successful logs: Processed immediately by Agent Analytics
Validation errors: Logged but entry still deleted from queue
Authentication failures: Queue paused, circuit breaker activated

Security Best Practices

Store API keys in environment variables rather than the database for production sites.
Ensure all sensitive areas of your site are excluded from logging.
Check the Status tab regularly to ensure logs are sending properly.
Use the “Send Test Event” feature to verify connectivity without affecting real data.
Ensure your WordPress site uses HTTPS to protect data in transit to your server.

If you discover any security issues or need assistance with configuration, please contact support@tryprofound.com immediately.

General

Agent Analytics

Single Sign-On (SSO)

​Required Fields

​Optional Fields

​Automatic Path Filtering

​Always Excluded Paths

​Request Type Exclusions

​Query Parameter Redaction

​Default Redacted Parameters

​Redaction Example

​Configuration Options

​General Settings

​Privacy Settings

​Advanced Settings

​API Key Security

​Storage Methods

​Custom Path Filtering

​Wildcard Pattern Examples

​Path Filtering Priority

​IP Address Handling

​Detection Order

​IP Privacy Considerations

​Data Retention

​Plugin-Side Retention

​API-Side Processing

​Security Best Practices

Required Fields

Optional Fields

Automatic Path Filtering

Always Excluded Paths

Request Type Exclusions

Query Parameter Redaction

Default Redacted Parameters

Redaction Example

Configuration Options

General Settings

Privacy Settings

Advanced Settings

API Key Security

Storage Methods

Custom Path Filtering

Wildcard Pattern Examples

Path Filtering Priority

IP Address Handling

Detection Order

IP Privacy Considerations

Data Retention

Plugin-Side Retention

API-Side Processing

Security Best Practices