=== WingPilot – Your AI Site Consultant & Security Expert ===
Contributors: ilyag
Tags: ai, site management, security, seo, content
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.5.30
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to WPPilot — AI that reads your content, understands your business, and makes specific, reversible improvements through chat.

== Description ==

WingPilot is the WordPress plugin half of [WPPilot](https://getwppilot.com), an AI site manager that actually knows your site.

**On the two names:** **WingPilot** is this plugin — the name in the WordPress.org directory, the folder it installs to, and its text domain. **WPPilot** is the service it connects to, and the name you'll see in your wp-admin menu and at getwppilot.com. Everything below that says "WPPilot" is describing the service.

WPPilot reads every page, post, and plugin on your site, builds a structured model of what your site is and who it's for, then writes you a Briefing — a magazine-quality assessment of what's working, what isn't, and where to start.

**What WPPilot does once connected:**

* **The Briefing** — A deep, editorial-quality analysis of your site delivered in the first 90 seconds. Not a checklist. Not a score. A real assessment written in clear language, with specific recommendations you can act on immediately.
* **Conversational actions** — Ask WPPilot to rewrite a post title, improve an excerpt, update a meta description, fix typos in body content, or unpublish stale content. Every change shows you a preview first (current vs. proposed, with rationale), and every change can be rolled back with one click. Nothing happens without your approval.
* **Multi-site cockpit** — Manage multiple WordPress sites from a single WPPilot account. The cockpit at app.getwppilot.com shows each site's status, recent findings, and Briefing insights at a glance.
* **Watchtower monitoring** — WPPilot continuously watches your site for security issues, content drift, and structural problems. Findings surface in the cockpit with severity indicators and timestamps.
* **Activity feed** — Every action WPPilot takes is logged with timestamps in the cockpit. Roll back any change. Full transparency, full reversibility.
* **Safe by design** — The plugin changes your site only when you approve a change in WPPilot. It sends site data (content, metadata, plugin list) to the WPPilot service for analysis, and every change goes through preview → approve → execute, with a one-click undo. You approve every change individually.

**What the plugin does locally:**

The plugin registers your site's REST API endpoints so the WPPilot service can read content and, when you approve an action, write changes. It maintains the secure connection (per-site cryptographic secret + JWT authentication) and provides the settings page where you manage the connection.

**Free tier included.** Install, connect, get your Briefing, try a few actions. No credit card required.

== External Services ==

**This plugin requires a connection to the WPPilot service to function.** The plugin's core value (the Briefing, conversational actions, AI analysis, Watchtower monitoring) is provided by that external service. Without a connection, the plugin provides no standalone functionality other than displaying and receiving the lead forms already placed on your pages; messages sent through those forms stay on your site and are never sent to the WPPilot service.

Below is every service this plugin, or a request it makes, communicates with, what is sent, and when.

= 1. WPPilot service — api.getwppilot.com =

Operated by WPPilot. Your site sends requests to it, and it reads from and (with your approval) writes to your site through the plugin's REST API (`/wp-json/wppilot/v1/`), authenticated by a per-site secret and a short-lived token.

**What is sent:**

* Site URL, WordPress and PHP versions, timezone, active plugins and themes with their versions and available updates.
* Post and page content (titles, excerpts, body text, page-builder data, metadata, publish date and author display name), menus, theme styles, Site Health facts and scheduled-task names — when the service requests them, for example to build the Briefing or preview a change.
* Where a piece of text you ask about appears on your site, when you use WPPilot's site-wide find: the posts, menus and widgets it appears in with a short surrounding snippet, and the names (never the values) of settings, theme settings and custom fields that contain it, with counts.
* A list of your posts, pages or products of one type, when you ask about all of them: each item's title, status, dates, lengths of its text and SEO description (not the text itself), whether it has a featured image, its language and translation group, and for WooCommerce products the SKU, stock status and price. Order, coupon, subscription, form-entry and lead records are never listed.
* Comments waiting for moderation, when you use comment moderation: each commenter's name and website URL, the domain of their email address (never the full address), the comment text, and the post it was left on. Commenters' IP addresses and browser details are not sent.
* The HTML of one of your public pages, when the service asks for it because a CDN or firewall in front of your site turned its own request away — the plugin requests that page from your site as an anonymous visitor (no login, no cookies), so it is only what any visitor already receives.
* Site activity events as they happen, so the service can show you an activity feed: logins (username and role), failed login attempts (the username or email address that was typed), user and role changes (username), new comments (the commenter's name) and comment moderation, plugin and theme changes, post edits, uploads, and changes to a few security-relevant settings such as the site address or the default user role (the setting's name only).
* Security scanning data: a list of scannable files with their sizes, timestamps and fingerprints, and the contents of files that are new or have changed since the previous scan, so malware detection can run on the service (see "What is NOT sent" below).
* Your WordPress admin email address, in the body of the request your site makes each time you click Connect, Finish connecting or Open WPPilot. WPPilot uses it only to propose your account address while no WPPilot account owns the site; you can change it before confirming. It is never put in a web address.

**When data is sent:**

* When you click Connect, Reconnect, Finish connecting or Open WPPilot in wp-admin.
* While the WPPilot admin page is open (connection status, recent activity, Briefing summary).
* Continuously, as activity events occur on your site while it is connected.
* During periodic heartbeats and scheduled security scans (approximately daily).
* When the WPPilot service requests content through the plugin's REST API.
* When you approve a change in WPPilot (the service sends the change to the plugin's REST API).
* When you delete the plugin: a one-time notice that the connection has ended.

Terms of Use: [https://getwppilot.com/terms](https://getwppilot.com/terms) — Privacy Policy: [https://getwppilot.com/privacy](https://getwppilot.com/privacy)

= 2. WPPilot web app — app.getwppilot.com =

When you click Connect, Finish connecting or Open WPPilot, your browser opens the WPPilot app. The address carries your site's URL, a single-use sign-in token that expires after a few minutes, and the WPPilot page to open. Your site's server sends nothing to the app itself. Same Terms of Use and Privacy Policy as above.

= 3. Image sources — Pexels and Openverse =

When you approve a new page or post that WPPilot illustrated with a stock photograph, your site downloads that image from where it is hosted and adds it to your own media library, so your page does not depend on someone else's server. WPPilot chooses images from [Pexels](https://www.pexels.com) (hosted at images.pexels.com) and from [Openverse](https://openverse.org), a WordPress.org project that indexes openly licensed images hosted elsewhere (for example Flickr and Wikimedia Commons); the download goes to the host the image came from, over https only. Nothing about your site is sent other than what any image download reveals: your server's IP address and WordPress's standard user agent, which includes your site's address. Nothing is downloaded until you approve the content.

* Pexels: [Terms](https://www.pexels.com/terms-of-service/) — [Privacy Policy](https://www.pexels.com/privacy-policy/)
* Openverse: [Terms](https://docs.openverse.org/terms_of_service.html) — [Privacy Policy](https://wordpress.org/about/privacy/); each image's original host has its own terms, linked from the image's Openverse page.

= 4. Your own site =

Two features make requests to your own site, not to a third party: after a change, the plugin requests the changed page once to see whether a cache in front of your site still serves the old copy; and the public-page read described above fetches one of your published pages as an anonymous visitor.

= 5. Updates for the copy downloaded from getwppilot.com — www.getwppilot.com =

Only the copy of the plugin downloaded from getwppilot.com does this; the copy installed from the WordPress.org directory never contacts getwppilot.com and is updated by WordPress.org. When WordPress checks for plugin updates (about twice a day) or you open the plugin's "View details", that copy reads one public file, `https://www.getwppilot.com/wppilot-update.json`, which says what the latest version is, and WordPress downloads that version from `https://www.getwppilot.com/wppilot.zip` when you, or WordPress's automatic updates if you turned them on, update it. Nothing about your site is sent other than what any download reveals: your server's IP address and WordPress's standard user agent, which includes your site's address. Same Terms of Use and Privacy Policy as above.

= What is NOT sent =

File *contents* are transmitted only from the directories that hold distributed software — WordPress core, plugins, themes and must-use plugins — and only for code files. This is a property of where a file lives, not a guess about what is inside it, which is what makes it dependable.

Everything else is inspected **on your server**, and only the finding is reported. That includes:

* `wp-config.php` and any other configuration file — still checked for injected or malicious code, because that is exactly where such code hides; its contents are never sent, so your database credentials and WordPress security keys never leave your server.
* `.htaccess`, `.user.ini` and similar server configuration.
* Everything in your uploads directory.
* Every data file — `.json`, `.xml`, `.txt` — wherever it lives, since these are where exported settings, service-account keys and pasted credentials collect.
* Private keys, certificates and key stores; database dumps, SQL files and archives; `.env`, `.htpasswd` and similar credential stores. These are never read for content at all.

For those files, what travels is a statement rather than the file: for example "this file contains two `eval()` calls, the first on line 14". No file content, no values, no credentials.

Also never sent: WordPress user passwords or password hashes, commenters' full email and IP addresses, messages received through WPPilot forms or through Elementor forms (WPPilot reads only how many each Elementor form has kept, never what visitors wrote), and the contents of your database's options table.

Files whose contents stay on your server are still fingerprinted, so if one is added or altered you are still told.

**An honest limitation.** Within plugin and theme source code, which is transmitted, a developer who stored a credential directly in their own PHP file may have that line sent. WPPilot removes the ones it can recognise, but it cannot promise to recognise every name a developer might choose. Configuration files — where credentials actually belong, and where yours are — are covered by the boundary above rather than by that recognition.

**A free account is required** at [app.getwppilot.com](https://app.getwppilot.com) to use this plugin. Accounts are created during the connect flow, proposing your WordPress admin email address, which you can change before confirming.

== Installation ==

1. Install directly from the WordPress plugin directory, or upload the `wingpilot` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Open **WPPilot** from the main wp-admin menu and click **Connect to WPPilot**. WPPilot opens in a new tab.
4. Click **Authorize** in the new tab. An account is created automatically with your WordPress admin email — confirm or change it. That completes the connection.

(Prefer to connect manually? The WPPilot admin page also shows your **Site Secret** with a Copy button under "Connection details", so you can paste your site URL + secret at [app.getwppilot.com](https://app.getwppilot.com) instead.)

Your Briefing will be ready in about 90 seconds.

== Frequently Asked Questions ==

= Do I need an account? =

Yes. A free account at [app.getwppilot.com](https://app.getwppilot.com) is required. The account is created automatically the first time you connect a site — you'll confirm your email address as part of the connect flow. The plugin connects your WordPress site to the WPPilot service; without the connection, the only thing it does on its own is keep any WPPilot forms on your pages working.

= What data does the plugin send? =

Site metadata (URL, WordPress/PHP versions, plugin list, theme), content (titles, excerpts, body text) when requested by the service, comments awaiting moderation when you use that feature, activity events while your site is connected, and security scanning data. Your WordPress admin email is sent to WPPilot in the body of the request each time you click Connect or Open WPPilot, so it can be proposed as your account address while no account owns the site; it is never put in a web address. See the full External Services disclosure above.

Security scanning still reads the files attackers actually modify — `wp-config.php` included, since skipping it would make for a poor security product. What it does not do is send them. Files outside WordPress core, plugin and theme code are inspected on your own server, and only the finding travels: "this file contains executable code it should not", never the file. Private keys, database dumps, archives and credential stores are not read for content at all. See the full External Services disclosure above.

= Can WPPilot change things on my site? =

Only with your explicit approval. Every write action (title rewrite, meta description update, excerpt change, content edit, post status change) shows you a preview first. You approve or reject each change individually. Every approved change can be rolled back from the activity feed in the cockpit.

= Can I manage multiple sites from one account? =

Yes. Install and connect WingPilot on each WordPress site you want WPPilot to manage. All sites connected with the same account email appear in your cockpit at app.getwppilot.com.

= Can I disconnect at any time? =

Yes. Open **WPPilot** from the main wp-admin menu and click **Emergency Disconnect** (you'll be asked to confirm). This immediately revokes all tokens and stops all backend communication. The plugin becomes inert. You can also disconnect individual sites from the cockpit at app.getwppilot.com.

= How do I try WPPilot on a test site? =

Install and activate the plugin on a site that is reachable from the internet, open **WPPilot** in wp-admin and click **Connect to WPPilot**, then **Authorize** in the tab that opens. Your Briefing follows in about 90 seconds; ask WPPilot to rewrite a post title to see a change previewed, approved and then undone from the activity feed.

= Does the plugin work on localhost? =

For the full experience, your site needs to be accessible from the internet so the WPPilot backend can reach the plugin's REST API. For local development, you can use a tunnel service like ngrok to expose your local site.

= Where do form messages go, and what happens to them if I delete the plugin? =

Each message sent through a WPPilot form is emailed to the address set for that form and saved under **WPPilot → Leads** in wp-admin. Saved leads stay on your site — they are not sent to the WPPilot service. Forms work whether or not your site is connected. If you delete the plugin, the form settings are removed but your saved leads are kept.

= What WordPress versions are supported? =

WordPress 6.0 and above, tested through 7.1, with PHP 8.0 or higher.

= Is WPPilot free? =

Yes, there's a free tier — install, connect, get your Briefing, and try the conversational actions without a credit card. Paid tiers (Starter, Pro, Agency) unlock higher usage limits and additional capabilities; see [getwppilot.com](https://getwppilot.com) for current pricing.

== Changelog ==

= 1.5.30 =
* Security: a change WPPilot makes to the words on a Beaver Builder or Bricks page is now refused if it would add a script, an event handler (such as `onclick`) or a script address, exactly as changes to a page body and to Elementor layouts already were. The same check now also covers custom fields and, with WingPilot Advanced Actions, settings that hold page text. Markup the text already held is kept; nothing unsafe is added, by a change or by its undo.
* Fixed: undoing a move to the trash no longer gives a post an address another post took in the meantime. Before, the post came back sharing that address (as a draft) or renamed with "-2" (when published). Now WPPilot says the address is taken and leaves the post in the trash, with nothing changed.
* New: when you ask where your form enquiries go, WPPilot now reads the notification recipients saved by Contact Form 7, WPForms, Formidable Forms and Gravity Forms (read-only), and names the site admin address where a form sends to it by default.

= 1.5.29 =
* Fixed: a change WPPilot makes to a page or post body now stores exactly what you approved. Before, block settings WordPress keeps escaped (an `&`, a quote, `<` or `--` inside a block's settings) lost their backslashes when saved, and a title, excerpt, new draft or meta description lost any backslash it contained.
* Fixed: WPPilot no longer changes a WooCommerce order as if it were a post. On stores that keep orders in their own tables, an order's number also names a placeholder post that is not the order; changing that post's status changed nothing about the order while reporting that it had. Orders, and any item whose type no active plugin registers, are now refused with the reason, and nothing is changed.

= 1.5.28 =
* Improved: when WPPilot changes a menu item's label or link, it now records the item's date along with its place in the menu, so undoing the change can confirm the item is back exactly where and as it was.

= 1.5.27 =
* Improved: when WPPilot answers a question about a whole set of your content — how many products are out of stock, which listings are duplicates, which pages have no meta description or no translation — your site now counts every item itself, so the numbers cover all of them even on a large or slow site where reading every item in time is not possible.

= 1.5.26 =
* Fixed: changing a menu item's label or link now changes only that label or link. Before, saving the item also reset its date and could move an item to the end of its menu, and undoing the change put the label back but not its place.

= 1.5.25 =
* Fixed: changing a menu item's label or link no longer moves it. Before, the renamed item left its submenu for the top level of the menu and could change places with its neighbours, and WPPilot then refused to undo the change because the item was no longer where it had been.
* Before WPPilot moves a post to the trash, it can now tell you how many of its comments are approved, waiting, spam or in the trash, since they are hidden along with the post.

= 1.5.24 =

* Security: the checks that keep scripts out of page content now read markup the way a browser does. An encoded address such as `&#106;avascript:`, a tab inside one, or an event handler separated by a slash (`<img/src=x/onerror=…>`) is refused like its plain spelling, for page and post bodies and for Elementor layouts. An Elementor layout can no longer gain a script, an event handler or a scripting address it did not already have.
* WPPilot's changes to an Elementor layout, and their undo, are now written only while the layout still holds what WPPilot read, so they never overwrite an edit made in the meantime.

= 1.5.23 =

* WPPilot can now go through every item of one kind at once — every tour, product, page or post — instead of a sample, so "how many products are out of stock?" or "which tours have no meta description?" gets an answer about all of them. It reads titles, statuses, whether an excerpt, meta description (in your SEO plugin's own field) and featured image are set, WooCommerce stock, price and SKU, and Polylang or WPML language versions. Never page text. Read-only: nothing is changed. Only an administrator's connection can run it.

= 1.5.22 =

* Fixed: undoing a change that moved a post or page to the trash now brings back its comments too, each in the status it had (waiting, approved or spam). Before, the post came back and its comments stayed hidden with the trashed post.
* WPPilot no longer moves a post to the trash on a site whose trash is switched off, where WordPress would delete it permanently instead.

= 1.5.21 =

* WPPilot can now tell you where a piece of text is stored across your whole site — an old domain, a phone number, a name — with how many times it appears in each place: page and post content (drafts and scheduled posts included), Elementor layouts (where button and link addresses are stored with their slashes escaped), custom fields, menus, widgets, Customizer settings and other settings. It also says what it did not search. Read-only: nothing is changed. Only an administrator's connection can run it; passwords, keys and anything stored under a credential-like name are counted but never quoted.

= 1.5.20 =

* WPPilot can now change a custom field on a post or page — for example one day of a tour's itinerary kept in an ACF, Pods, Meta Box or JetEngine field — after you approve it, with undo. Only the one value you asked about changes: the other rows and sub-fields of the field are written back exactly as they were, the field is checked again just before it changes (anything you changed yourself in the meantime is left alone), ACF fields are saved through ACF itself, and undo puts back exactly what was there. Fields WordPress or a plugin keeps for itself, passwords and keys, fields that link to other content or media, and anything stored as a PHP object are never changed this way.

= 1.5.19 =

* When WPPilot reads a post or page, it now also reads the post's custom fields — the itinerary, price lists, specifications and other details that sites built with Pods, ACF, Meta Box, JetEngine or Toolset keep outside the main content and show through their templates. Before, a page whose words all live in custom fields looked empty to WPPilot even though visitors saw it in full. Fields are read with their labels where the field plugin provides them; passwords and anything shaped like a key or credential are never sent, and only users who can edit the post have its fields read.
* When your homepage's search title comes from your site title and tagline, WPPilot now reads what changing them would reach on your site — each language version of the homepage, with the tagline as that language shows it under Polylang or WPML, and the title of another page — instead of assuming it, so it can prepare the homepage title you asked for and tell you exactly what else it changes.

Earlier versions are listed in changelog.txt, included with the plugin.

== Upgrade Notice ==

= 1.5.30 =
Builder page text, custom fields and settings can no longer gain a script or event handler; undoing a trash never reuses an address another post took.

= 1.5.29 =
Page and post changes keep escaped block settings and backslashes exactly; WooCommerce orders are no longer changed as if they were posts.

= 1.5.28 =
Undoing a menu item change now confirms the item's date as well as its place.

= 1.5.27 =
Counts over a whole content type (stock, duplicates, descriptions, translations) now cover every item, however large the site.

= 1.5.26 =
Menu label and link changes, and their undo, leave everything else about the item as it was.

= 1.5.25 =
Fixes menu label changes moving the item out of its submenu.

= 1.5.24 =
Security hardening: encoded or unusually spelled scripts are refused in page content and Elementor layouts, and Elementor changes never overwrite an edit made in the meantime.

= 1.5.23 =
Lets WPPilot answer questions about all of your tours, products or pages at once (counts, missing descriptions, stock, translations) instead of a sample.

= 1.5.22 =
Undoing a move to the trash now restores the post's comments as well as the post.

= 1.5.21 =
Lets WPPilot find where a piece of text (such as an old domain) is stored across your whole site, with counts by place, before anything is changed.

= 1.5.20 =
Lets WPPilot change a custom field value (such as one day of an itinerary) on the posts you choose, with your approval and undo.

= 1.5.19 =
Lets WPPilot read the custom fields (Pods, ACF, Meta Box, JetEngine, Toolset) your pages are built from, so it no longer mistakes a page filled from custom fields for an empty one, and lets it see what a tagline change would reach on your site before it tells you.

= 1.5.18 =
Lets WordPress offer you WingPilot's updates — with details, one-click update and auto-updates — when you installed it from getwppilot.com.

= 1.5.17 =
Lets WPPilot read what each of your plugins says it does, change the title search engines show in Yoast SEO or Rank Math, and tell you honestly where that title comes from on sites without an SEO plugin.

= 1.5.16 =
Lets WPPilot see whether your Elementor forms keep their enquiries and whether your site can reliably send their emails.

= 1.5.15 =
Lets WPPilot open or close comments on the posts and pages you choose, with undo.

= 1.5.14 =
Reports update status honestly for plugins outside WordPress.org, names Hello Dolly correctly, and lets WPPilot see must-use plugins, drop-ins and who made each plugin.

= 1.5.13 =
Fixes abilities notices on WordPress 6.9+, keeps your admin email out of web addresses, and makes the WPPilot page fast and its connect errors clear when WPPilot is unreachable.

= 1.5.12 =
Lets WPPilot add buttons and forms to your Elementor pages and templates in your site's own style, and see the other language versions of a translated page or template.

= 1.5.11 =
The "Connect this site" step comes first after activation, with a dismissible reminder on the Plugins screen and Dashboard until the site is connected.

= 1.5.10 =
Lets WPPilot read your public pages from your own site when a CDN or firewall bot check turns its request away.

= 1.5.9 =
WPPilot says where a shared Elementor template or form appears before it proposes a change to it.

= 1.5.8 =
Lets WPPilot fix your own Elementor forms and shared templates, with your approval and an Undo.

= 1.5.7 =
WPPilot reports a plugin's update status as unknown, rather than current, when WordPress's own check did not complete.

= 1.5.6 =
A clear connection status, a one-click Reconnect that reports its result, and no endless retries when WPPilot refuses this site.

= 1.5.5 =
Lets WPPilot clear spam from your comment moderation queue, with your approval and an Undo.

= 1.5.4 =
Elementor's fonts follow your site when WPPilot moves it off a staging address.

= 1.5.3 =
Lets WPPilot safely remove a form that is on no page; its messages are kept.

= 1.5.2 =
One meta description per page on Hello Elementor sites.

= 1.5.1 =
Fixes site activity not reaching WPPilot after the plugin's sign-in lapsed.

= 1.5.0 =
Working contact and quote forms with spam protection, and new pages created as Elementor pages on Elementor sites.

= 1.4.9 =
Approved meta descriptions now appear on sites without an SEO plugin.

= 1.4.8 =
Security scans now work on hosts with strict firewalls.

= 1.4.7 =
Security scans check every file on your site; previously a few files could be left out.

= 1.4.6 =
WPPilot can see every installed theme, so it can tell you which ones are safe to remove.

= 1.4.5 =
After a menu change WPPilot tells you whether a cache in front of your site is still serving the old menu, instead of leaving you to find out.

= 1.4.4 =
Menu changes made through WPPilot now reach your cached pages straight away instead of waiting for the cache to expire.

= 1.4.3 =
WPPilot now knows which WordPress permissions were checked, so it can rename menu items and make other changes that need a permission the earlier check never asked about. Read-only otherwise.

= 1.4.2 =
A change WPPilot makes to a page-builder page now reaches your host's page cache straight away instead of waiting for the cache to expire.

= 1.4.1 =
WPPilot can now see whether a page cache or object cache is wired into your site, including one your host installed, so it stops recommending a cache you already have. Read-only.

= 1.4.0 =
WPPilot can now read a page as your page builder stores it and see your Site Health facts, so it stops guessing about builders it was never taught and about why a site is slow. Credential-looking values are removed on your site before anything is sent. Read-only; adds no new way to change your site.

= 1.3.0 =
Your site now tells WPPilot which plugins, themes and core have updates waiting, so it stops guessing staleness from a version number. Also sends each post's publish date and author, and can recover a connection your account no longer recognises. Read-only; adds no new way to change your site.

= 1.2.1 =
WPPilot now reads your plugin list in your site's own language, so the names it tells you match the ones on your Plugins screen. Read-only; adds no new way to change your site.

= 1.2.0 =
Lets WPPilot see every page and post on sites with more than fifty of them, instead of treating the first fifty as the whole site. Read-only; adds no new way to change your site.

= 1.1.2 =
Your site now tells WPPilot which endpoints it actually serves, so WPPilot stops inferring that from a version number. No additional site content or personal data is collected; this release reports which WPPilot endpoints the plugin itself has registered, and adds no new way to change your site.

= 1.1.1 =
Lets WPPilot tell you honestly what it can and cannot do on this site. This release only reports whether an Advanced Actions module is present — it installs nothing, downloads nothing, and adds no new way to change your site.

= 1.1.0 =
Security and privacy release. Your configuration files — including wp-config.php — are now inspected on your own server and no longer sent to the service, while still being checked for injected code. Opening WPPilot from wp-admin now signs you in and lands on the right page.

= 1.0.0 =
First public release. Install, connect, and get your first Briefing.
