# SEF Chat Pro Security Notes

Implemented security controls:

- OpenAI API key is stored in WordPress options and used server-side only.
- Admin settings/index/license/update actions require `manage_options`.
- Public chat AJAX verifies WordPress nonce.
- Optional same-site origin guard is enabled by default.
- Per-session rate limiting is enabled.
- User input is sanitized before use.
- Bot output is filtered through an allowlist of safe HTML.
- Visitor IP is stored as a hash.
- Basic browser security headers are sent on frontend pages.

Before production:

- Use HTTPS only.
- Keep WordPress, WooCommerce and PHP updated.
- Use strong admin passwords and 2FA.
- Keep debug log disabled on production unless troubleshooting.
- Do not expose the `license-update-server` folder publicly from inside the plugin directory on client sites. Deploy it separately.
