AbilityGuard – Abilities API Monitor

AbilityGuard helps site administrators understand and audit what the WordPress Abilities API exposes on their site. The WordPress Abilities API gives plugins, themes, AI tools, automation workflows, and other integrations a structured way to register and execute site capabilities. That is powerful, but it also creates a new visibility problem: administrators need to know which abilities are available, how those abilities are described, whether they are exposed through REST, and what executions have happened recently. AbilityGuard adds that visibility layer. It inventories registered abilities, highlights risk-related annotations, and keeps a rolling execution log so you can review what ran, who triggered it, how it was triggered, and what data was stored. What problem does AbilityGuard solve? Without an inventory or audit trail, administrators may not know:

• Which abilities are registered by active plugins or integrations.
• Whether an ability is marked as read-only, destructive, or idempotent.
• Whether an ability is exposed through REST.
• Which abilities executed recently.
• Which user triggered an ability execution.
• Whether input or output payloads were captured for review.

AbilityGuard is designed to answer those questions from the WordPress admin area. Features AbilityGuard turns the WordPress Abilities API into a clear, auditable surface for site administrators. Instead of chasing capability registrations manually, you get a focused dashboard for visibility, risk review, and execution monitoring. Core Visibility

• Ability Inventory: view all registered WordPress abilities in a single, searchable inventory.
• Risk Badges: instantly spot risk indicators derived from ability annotations.
• Annotation Visibility: inspect read-only, destructive, and idempotent metadata at a glance.
• Category & Namespace Details: see the official category, slug, and namespace used by each ability.
• REST Exposure & Schema Visibility: identify abilities exposed through REST and whether input/output schemas are registered.
• Current User Permission Check: confirm whether the current admin user can execute an ability with its default input.

Execution Monitoring

• Execution Log: review recent ability executions with a rolling audit trail.
• Log Details: inspect names, users, trigger context, status, and payload data for each event.
• Trigger Context: see whether an execution came from REST, WP-CLI, cron, or PHP.
• User Links: jump directly from a log entry to the related WordPress user profile when available.

Admin Controls & Privacy

• Configurable Payload Logging: choose whether to capture ability input and output data.
• Privacy-Conscious Defaults: output logging is disabled by default to reduce sensitive data exposure.
• Configurable Log Retention: keep as many execution entries as needed, including unlimited retention.
• Advanced Log Filters: narrow the activity view by status, context, risk, category, user ID, date range, or search term.
• CSV Export: export the current filtered log view for reporting or review.
• Saved Views: save common audit filters for fast reuse.

Operational Oversight

• Sensitive Watchlist: flag important abilities for closer monitoring.
• Email Alerts: receive notifications for high-risk, failed, or watched ability executions.
• Scheduled Reports: send daily or weekly activity summaries by email.
• Multisite Dashboard: review per-site ability and log counts from Network Admin.
• Uninstall Cleanup Option: optionally remove AbilityGuard data when the plugin is uninstalled.

What AbilityGuard does not log AbilityGuard monitors Abilities API registrations and executions. It does not replace a general WordPress activity log plugin. For example, AbilityGuard does not automatically log normal post edits, page updates, media uploads, settings saves, WooCommerce activity, or user profile changes unless those actions are performed through a registered WordPress ability. Privacy and data storage AbilityGuard stores logs in a custom database table in your WordPress database. Input logging can be enabled or disabled from the settings page. Output logging is available but disabled by default because ability responses may contain sensitive or large data. Before enabling output logging, review your site's privacy and compliance requirements.

1.1.1

• Fixed multisite uninstall cleanup so data removal now runs for all sites, not only the main site.
• Added inventory detail popup behavior consistent with the execution log details modal.

1.1.0

• Added configurable and unlimited log retention.
• Added advanced execution log filters.
• Added CSV export for filtered logs.
• Added saved log views.
• Added sensitive ability watchlist.
• Added email alerts for selected ability activity.
• Added scheduled activity reports.
• Added multisite Network Admin dashboard.
• Improved filter behavior for independent filter selections.

1.0.0

• Initial release.
• Added Ability Inventory for registered WordPress abilities.
• Added risk badges based on Abilities API annotations.
• Added category, namespace, REST exposure, permission, and schema visibility.
• Added Execution Log with a rolling 100-entry retention limit.
• Added detailed log view with user links, trigger context, input, and output sections.
• Added settings for input logging, output logging, and uninstall cleanup.
• Added custom database table for execution logs.
• Added admin styles and directory index guards.