WordPress AI team notes for 7.1 focus on the AI Client as a foundation for plugin authors, including generation streaming and an embeddings experiment. Even when the default WordPress interface does not show AI features, installed plugins may begin using the client in ways that touch content, metadata, prompts, logs, and external providers.
Use this for WordPress sites that install AI writing, search, support, translation, documentation, content operations, or internal admin plugins that may build on the AI Client or related provider connectors.
Quick answer
WordPress 7.1 AI Client Privacy and Capability Review should be handled with a narrow evidence-first workflow: map ai triggers, limit capabilities, review data sent, then verify the result before making broader changes.
What to check first
- Ask which plugin feature calls the AI Client and what WordPress capability is required to trigger it.
- Confirm whether content, excerpts, private posts, user data, orders, form entries, or media metadata can be sent to a provider.
- Decide whether streaming responses are logged, cached, stored in post meta, or visible to other users.
- If embeddings are used, document what content is embedded, where vectors are stored, and how deletions are handled.
- Review application passwords, API keys, connector settings, and audit logs after enabling AI features.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|---|---|
| Map AI triggers | Ask which plugin feature calls the AI Client and what WordPress capability is required to trigger it. | Only approved roles can run the AI-assisted workflow. |
| Limit capabilities | Confirm whether content, excerpts, private posts, user data, orders, form entries, or media metadata can be sent to a provider. | Private content and customer data are excluded unless there is a clear policy reason. |
| Review data sent | Decide whether streaming responses are logged, cached, stored in post meta, or visible to other users. | Prompt, response, and embedding retention rules are documented. |
| Document storage | If embeddings are used, document what content is embedded, where vectors are stored, and how deletions are handled. | Disabling the plugin or feature stops new provider calls. |
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
ai_feature_review:
plugin: example-ai-helper
trigger_role: editor
sends_private_content: no
stores_prompt: yes, 30 days
embeddings_store: wp_ai_vectors
deletion_rule: remove vectors when post is trashed
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Map AI triggers
- Limit capabilities
- Review data sent
- Document storage
- Audit credentials
Production verification checklist
- Only approved roles can run the AI-assisted workflow.
- Private content and customer data are excluded unless there is a clear policy reason.
- Prompt, response, and embedding retention rules are documented.
- Disabling the plugin or feature stops new provider calls.
Mistakes to avoid
- Do not judge the fix by one browser or the homepage only.
- Do not delete evidence before recording usernames, file paths, timestamps, and response headers.
- Do not add a cache, security, or tracking plugin while the original problem is still unclear.
- Do not leave test users, temporary debug logs, or broad API keys active after verification.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, malware risk, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, review AI features on WordPress.