FAQ
Will an audit change anything on my site?#
No ability is executed. Permission callbacks are called as in-memory users that never touch the database, and user-meta writes for those users are blocked while each check runs. Audit results are stored in the plugin’s own table. A permission callback is third-party code, so a badly written one could still do something unexpected when called; Ability Auditor contains what it can (output, notices and wp_die() are captured, execution is blocked). When in doubt, run the first audit on a staging copy.
Where do I enter my license key?#
Under Tools > Ability Auditor License. One key activates the number of sites your plan allows; click Deactivate License on a site to free its slot. Keys are managed in your account at technoleet.dev.
Where do updates come from?#
From technoleet.dev, through the StoreEngine SDK bundled with the plugin. WordPress.org is never consulted for this plugin, so a WordPress.org plugin with the same slug can never replace it. Updates are only offered while the license is valid.
Does the plugin stop working when the license expires?#
No. Audits, reports, exports, scheduled audits and WP-CLI keep working. You stop receiving updates and support until the license is renewed.
Why do logged-in roles use unusual user IDs?#
Core’s is_user_logged_in() only checks that the user ID is not 0. If simulated subscribers had ID 0, abilities that only check “is anyone logged in” would look locked down. Each simulated role gets an ID near the top of the integer range that cannot belong to a real user.
What does “Inconclusive” mean?#
The audit could not tell whether the role is allowed. Usually the permission check threw an error, called wp_die(), returned a WP_Error, ran too long, tried to run an ability, or depends on the input rather than the role (for example, it denied every role including Administrator). Open the ability’s detail panel to see the reason.
Does it work on multisite?#
Yes. Each site is audited on its own, with its own history and settings, from that site’s Tools menu. When the plugin is network-activated the license is managed from the Network Admin.
Does it work on WordPress 6.9 and 7.0?#
Yes. Features added in 7.1, such as the public flag and the pre-execution filter, are detected in code and used only when present. The Report tab shows a notice explaining the difference.
Does it send any data anywhere?#
No telemetry, no external code, no usage tracking. Audit results stay in your database. The only email it sends goes to your own admin address, and only when alerts are on. The license SDK contacts technoleet.dev only for license activation, deactivation, re-checks and update checks.
Does the audit slow down my site?#
No. An audit only runs when you click Run audit, when WP-Cron fires the daily or post-update event, or from WP-CLI. Nothing runs on normal page loads. The Inventory tab reads definitions only.
Can I audit just one plugin’s abilities?#
Not as a separate audit, but on the Report tab you can sort and search by owner, and on the Inventory tab you can filter by owner. The CSV export includes the owner column for filtering in a spreadsheet.