> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wpbevel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> Tokens, what leaves the site, what the endpoint refuses, and what an assistant cannot do.

## The connection token

Each connection has a random 48-character secret, stored on the site only as a SHA-256 hash. It is shown once, when the connection is created. A valid token runs the request as the WordPress user who created the connection, with that user's capabilities. Revoked or unknown tokens get 401.

The token can arrive in the `Authorization: Bearer` header or in the URL. The header is read first and is the better place: a token in a URL lands in server logs and browser histories. Claude Code's setup command uses the header; the web connectors only take a URL, so the URL form stays. The connection row says which way each connection presents its token.

## What the endpoint refuses

* A request whose JSON-RPC envelope is malformed.
* A browser page on another site (an Origin header that is not this site's own), before any token is read. Server clients send no Origin. The `bevel_mcp_allowed_origins` filter adds hosts of your own.
* More than twenty failed authentications from one address in a minute (429 for the rest of it).
* More than 120 tool calls from one connection in a minute.
* A file on an upload link whose connection has been revoked, or whose capability has been switched off since.

A tool that throws answers as a tool error the assistant can read, never as a fatal page.

## What leaves the site

Nothing, unless a tool is called that needs it:

* **my.wpbevel.com**, on a site connected to a Bevel account: before the first page or blog post of the day, to read the allowance, and after each one, to count it. It receives the license key, the site's address and activation id, the tool's name and the plugin version, never the content. It is also asked about Bevel MCP updates when WordPress checks for them, and for today's count when **Bevel → MCP Connectors** is opened.
* **api.openverse.org** receives the search words when the assistant looks for a photo, with your site's address in the user-agent line. Choosing a result downloads that image from wherever it is hosted.
* **The website named to `fetch_brand`**: its homepage, up to three stylesheets and the logo images it links.
* **A Google Drive or Dropbox link you paste**, fetched in its direct-download form.

No page, post or template is ever sent to a Bevel server. When the assistant calls a tool, the request comes from the assistant to your site and the answer goes back to it; that conversation is covered by the assistant's terms.

## What stays on the site

Credentials stored in widget settings (a form's Mailchimp key, a Slack webhook) are redacted when a page is read and restored when the page is saved back. They never reach the assistant.

## What an assistant cannot do

Delete a page, post, template, menu or media file. Publish without being asked. Upload a file that is not an image or a font. Change another user's account. Reach a capability the site or the connection has switched off.

## Uninstalling

Deleting the plugin removes its connections, settings, log and upload receipts, and nothing else. Everything the assistant built is the site's content and stays.