WordPress 7.0 introduced the Abilities API. Any active plugin can register an ability and the WordPress AI feature can then invoke it, consuming whatever credits or tokens your AI provider charges per call. By default every registered ability is exposed, and there is no built-in way to see what is e
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 7.0 and PHP 7.4.
SourceWordPress plugins · Oct 23, 2026
01 / Source details
Aboutthistool.
WordPress 7.0 introduced the Abilities API. Any active plugin can register an ability and the WordPress AI feature can then invoke it, consuming whatever credits or tokens your AI provider charges per call. By default every registered ability is exposed, and there is no built-in way to see what is exposed or to limit it.
Codevera AI Access Control adds a single settings screen that lists every plugin which has registered AI abilities, grouped by source plugin, and lets you allow or block each plugin as a whole or each individual ability.
How it works:
01The plugin watches every call to wp_register_ability() and records which plugin made the call.
02The Settings -> Codevera AI Access screen groups those abilities by source plugin so you can see at a glance what is exposed.
03Untick a plugin or a single ability and save. From the next request onwards, the AI feature can no longer see or invoke it.
Free:
Per-plugin and per-ability granular controls
Automatic detection of newly installed plugins that register AI abilities, with an in-admin notification so you can review them
Tamper-detect signature on the saved settings, with a fail-closed mode that blocks every non-core ability if the settings option is modified outside the plugin
Filter-level enforcement that neutralises a blocked ability before WordPress constructs it, plus a registry sweep that removes blocked abilities from the listings
Self-check that re-attaches the enforcement hooks on init, admin_init and rest_api_init if another plugin removes them
Search and filter inside each plugin card so large registries stay readable
No external requests, no telemetry, no licence checks
Sites where editorial staff use the WordPress AI feature and you want strict control over what context the AI can pull in
Agency sites where new plugins are installed regularly and you want to review their AI exposure before letting them in
Privacy-sensitive sites that need an explicit allow list of which plugins may expose data to an AI provider
Compliance-driven environments that need an auditable record of which plugins have been allowed to register AI abilities
Under the hood:
Uses only the official Abilities API surface: wp_register_ability_args , wp_abilities_api_init , wp_unregister_ability
Source attribution from debug_backtrace() of the file that called wp_register_ability , normalised to a plugin slug
HMAC-SHA256 signature on the settings option, keyed to a CVAIAC_SECRET constant or AUTH_SALT fallback
No frontend assets shipped, all code runs in admin and on the AI Abilities REST routes
No database tables, just two options in wp_options
External Services & Privacy
This plugin does not contact any external service. It reads only local WordPress data. No telemetry, no analytics, no licence checks, no remote update checks beyond what WordPress core itself performs.
The plugin stores two options in the wp_options table:
cvaiac_settings – your allow and block selections, signed with an HMAC-SHA256 signature
cvaiac_ability_sources – a map of ability name to source plugin slug, populated automatically as plugins register their abilities
cvaiac_schema_version – an integer that records the storage format version, used for migration
No personal data, no visitor data, and no AJAX requests to remote services.
When the plugin is uninstalled, all three options are removed.
Support
Email info@codevera.ai for support, bug reports, or feature requests. Include your WordPress version, PHP version, a list of other plugins that register AI abilities, and a description of the issue with steps to reproduce.
Technical Requirements
Minimum:
WordPress 7.0 (required for the Abilities API)
PHP 7.4
Recommended:
WordPress 7.0 or higher
PHP 8.0 or higher
Privacy & Security
The plugin does not collect or transmit any personal data. The settings option is stored locally and signed with an HMAC keyed to a site-specific secret. The source-tracker option contains only plugin slugs and ability names that are already public to any code running on the site.
Form submissions use a nonce and require the manage_options capability. The enforcement hooks run on every request that loads the Abilities API, so blocking takes effect from the next request after a setting is saved.
This plugin defends against opportunistic interference such as another plugin writing directly to the settings option, removing the enforcement hooks, or re-registering an ability that has already been blocked. It does not claim to be a security boundary against a fully hostile plugin that has code execution in the same PHP process. The safest practice is still to only install plugins you trust.
Links
Website: https://codevera.ai
Support: info@codevera.ai
See it in action
A closer look.
Settings screen showing every plugin that has registered AI abilities, grouped by source, with per-plugin and per-ability checkboxes
02 / Source details
Gettingstarted.
From WordPress admin:
01Go to Plugins -> Add new
02Search for “Codevera AI Access Control”
03Click Install now and then Activate
04Go to Settings -> Codevera AI Access
05Review the list of plugins that have registered AI abilities
06Untick anything you do not want the AI feature to use
07Click Save changes
Manual installation:
08Download the plugin zip file
09Upload to the /wp-content/plugins/ directory
10Extract the files
11Activate through the Plugins menu in WordPress
12Configure as described above
Optional hardening:
Add the following line to your wp-config.php to use a dedicated secret for the settings signature, rather than reusing AUTH_SALT :
This makes it harder for an attacker who only has database access to forge a valid settings blob.
After activation:
13Visit Settings -> Codevera AI Access to see which plugins have registered abilities
14Untick any plugin or ability you do not want to expose to the AI feature
15Save changes
16When a new plugin is installed and registers an ability, you will see a Newly detected items banner the next time you open the settings screen
03 / Source details
Frequently asked questions.
Does this plugin make any external network requests?
No. It reads only local WordPress data and never contacts any third-party service. No telemetry, no analytics, no licence checks.
Does it store any personal data?
No. It stores only your allow and block selections and a short list of plugin and ability identifiers in the WordPress options table.
How does it actually block an ability?
Two layers. First, on the wp_register_ability_args filter at the highest priority, the plugin rewrites the execute_callback and permission_callback of any blocked ability to return a cvaiac_blocked WP_Error. This neutralises the ability before WordPress even constructs it. Second, on the wp_abilities_api_init action at the highest priority, the plugin walks the registry and calls wp_unregister_ability() on anything blocked, so it disappears from the listings entirely.
Can I block WordPress core abilities?
You can block individual core abilities, but the WordPress core group as a whole cannot be blocked. Blocking individual core abilities can prevent the AI feature from working correctly, so do it with care.
What is the tamper-detect mode?
The settings option is stored as a JSON payload with an HMAC-SHA256 signature, keyed to a CVAIAC_SECRET constant or AUTH_SALT . Each time the plugin reads the option, the signature is recomputed and checked. If it does not match, the plugin enters fail-closed mode and blocks every non-core ability until an administrator re-saves the settings through the UI. A red banner appears on the settings screen explaining what happened.
Why is fail-closed important?
A malicious or buggy plugin running on the same site can call update_option( 'cvaiac_settings', array() ) to wipe your block list. With tamper detect, that write produces an invalid signature, the plugin notices, and the AI feature loses access to every plugin’s abilities until you investigate and re-save.
Can a hostile plugin still bypass this?
A determined plugin with code execution on the same site can in principle override the pre_option_cvaiac_settings filter, remove the enforcement hooks, or read CVAIAC_SECRET from wp-config.php to forge a valid signature. This plugin defends against opportunistic interference, not against a fully hostile plugin in the same PHP process. Treat it as a policy and tamper-detect tool, not a security boundary. The safest practice is still to only install plugins you trust.
Does it work on multisite?
Yes. Settings are stored per-site, so each sub-site can have its own allow and block list.
Does it work with the REST API run endpoint?
Yes. Blocked abilities are unregistered from the registry, so the WordPress core REST run endpoint cannot find or execute them.
What happens when I uninstall the plugin?
All of the plugin’s options are deleted by uninstall.php . No data is left behind.
Can I translate this plugin?
Yes. The text domain is codevera-ai-access-control . PO files can be generated with WP-CLI or any standard translation tool.
How do I troubleshoot?
Enable WP_DEBUG and WP_DEBUG_LOG in wp-config.php . The plugin uses only standard WordPress APIs, so any issue will appear in the standard debug log.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
