WordPress AI: what data is sent, in one paragraph. Saving an API key in Settings > Connectors does not, by itself, turn on any feature that sends your content anywhere. WordPress core has no built-in feature that sends your posts to an AI provider automatically. Data leaves your site only when a plugin builds a request through the WordPress AI Client. That request carries whatever the plugin puts in it: prompt text (which can include your draft), attached files, earlier turns of a conversation and instructions. It is authenticated with your key. What the provider keeps afterward, and whether it trains on it, is set by the provider's terms, not by WordPress.
Written against WordPress 7.1.2. Last verified 2026-09-23 against the Make WordPress Core developer notes linked below. We describe what the WordPress documentation shows; we have not run our own traffic tests.
If you have not connected a provider yet, start with our Settings > Connectors setup guide and come back here before you switch on any AI feature.
The short version: four questions, four different owners
Most confusion about AI privacy in WordPress comes from asking one party a question that another party controls. WordPress controls the plumbing. Your plugins control what goes into the pipe. The provider controls what happens at the other end. You control who on your site can open the tap.
| Question | Who decides | Where to check |
|---|---|---|
| Is anything sent at all? | The plugins you install and turn on | Plugins > Installed Plugins, then each plugin's settings |
| What goes inside each request? | The plugin that builds the prompt | The plugin's directory page and readme |
| What happens to it after it arrives (storage, training)? | The AI provider | The provider's terms for API use, read on their own site |
| Who on your site can trigger a request? | You, through user roles, plus the plugin's permission checks | Users > All Users |
Keep this table in mind for the rest of the page. Every section below expands one row.
What WordPress core itself does in 7.0 and 7.1
WordPress 7.0 added two pieces that work together. The Connectors API stores provider keys and powers the Settings > Connectors screen. The AI Client is the code that plugins call to send a prompt and get a result back.
The Make WordPress Core post Introducing the AI Client in WordPress 7.0 (published March 24, 2026; we read it on September 23, 2026) states it plainly: "WordPress Core does not bundle any AI providers directly. Instead, they are developed and maintained as plugins." The Connectors screen features three providers and helps you install their plugins, but the sending happens through plugin code, not through a core feature that runs on its own.
WordPress 7.1 did not change this picture. The 7.1 Field Guide on Make WordPress Core lists a single AI Client ticket (#65504), a developer-facing fix to how the client runs "abilities." It adds no new feature that sends site content to a provider. If you are still weighing whether AI belongs in core or in a plugin on your site, our explainer on core features versus plugins in WordPress covers how to decide.
WordPress AI: what data is sent, moment by moment
There are four moments worth separating, because each one sends something different.
1. When you save a key
The Make WordPress Core post Introducing the Connectors API in WordPress 7.0 (published March 18, 2026; read September 23, 2026) explains where the key goes: into a database option named on the pattern connectors_ai_{provider}_api_key. In the post's words, "API keys stored in the database are not encrypted but are masked in the user interface." WordPress checks an environment variable first, then a PHP constant, and only then the database value.
That post does not say whether saving a key contacts the provider to test it. If that matters to you, the provider's own usage or activity page is the record to check.
2. When a plugin runs a prompt
This is the moment your content actually leaves. According to the AI Client developer note, a plugin can include:
- Prompt text, which may contain a post, a draft, an excerpt or anything else the plugin reads
- Files, attached through the client's
with_file()method - Conversation history, through
with_history() - System instructions and generation settings
The AI Client uses WordPress's own HTTP transport, which runs on your server. So the request travels from your web server to the provider, authenticated with your key.
3. When the answer comes back
The provider returns generated output to the plugin. Where it lands (a block, a field, a post, a log) is the plugin's choice. WordPress core does not keep a documented record of prompts sent; the AI Client note contains no discussion of logging.
4. When your site is copied
Because the key sits unencrypted in the database, it travels with every full database export, backup and staging copy. That is data leaving your site too, just not to an AI provider. If you test updates on a copy of your site, that copy holds a working key unless you remove it or keep the key in an environment variable instead.
What can end up in a prompt without you typing it
The quiet risk is not the text you paste into an AI box. It is the content a feature reads on its own. The data sent depends entirely on what the feature does:
- A summary or rewrite feature has to send the post or block it is working on.
- An image description or alt text feature has to send the image, or a version of it.
- A feature that works on comments, form entries or search queries would send text your visitors wrote, which may include names, email addresses or other personal details.
None of this is a WordPress default. Each is a design choice by a plugin author. The practical test: before you turn a feature on, ask "what does this feature need to read to do its job?" Whatever it reads is what it sends.
The visitor case deserves the most care. Your visitors never agreed to a provider's terms; you did. If any AI feature touches visitor-written content, your privacy policy should say so.
Is my draft being used to train something?
This is the question most readers arrive with, and the honest answer is that WordPress cannot tell you. The WordPress developer notes cover how requests are built and sent. They contain no statement about what a provider stores, for how long, or whether it trains on API input, because WordPress does not control that.
The answer lives in the provider's own terms for API customers. When you read them, look for these specific points and write down the date you read each one:
- Whether data sent through the API is used to train or improve models, and whether that is on or off by default
- How long inputs and outputs are kept, including any separate retention for abuse monitoring
- Whether you can opt out, and whether the opt-out is a setting or a request
- Whether a data processing agreement is offered, if you handle personal data under laws such as the GDPR
Read the API terms, not the terms for the same company's consumer chat app. They are separate documents and may not say the same thing. Providers also revise these pages, so an answer copied from a blog post (including this one) is not a substitute for the current page.
Who on your site can make data leave
A key in Settings > Connectors is shared by every compatible plugin, so the real question is who can trigger those plugins.
The AI Client note offers two routes. Its JavaScript API "requires a high-privilege capability check, which by default is only granted to administrators." Its recommended route for plugins is a separate REST endpoint per feature, each with its own permission check. That means an editor or author may be able to trigger requests if the plugin author allowed it. Check each AI plugin's documentation for which roles can use its features.
For developers, the note also documents a filter, wp_ai_client_prevent_prompt, that can block specific prompts, with an example that blocks non-administrators. Adding it is code work, so treat it as a request for your developer, not a settings change.
On your side, the simplest control is knowing who holds which role. Our guide to WordPress user roles walks through giving people the access they need without handing out administrator.
Five checks before you switch on an AI feature
- Go to Settings > Connectors. Note which providers show as connected and where each key comes from: environment variable, PHP constant or database. The Connectors developer note says each card shows the key's source.
- Go to Plugins > Installed Plugins. List every plugin that offers AI features. Open each one's WordPress.org page and readme. The WordPress.org plugin guidelines (Detailed Plugin Guidelines, page updated March 11, 2026) require that a plugin using an outside service be "clearly documented in the readme," and say plugins "may not contact external servers without explicit and authorized consent." If a plugin's page does not tell you what it sends, ask the author before enabling it.
- Read the provider's API data terms. Use the four points in the training section above and record the date.
- Go to Settings > Privacy. Open your privacy policy page and the "Check out our guide" link. If any AI feature processes visitor content, update the policy page to say which provider receives it.
- Go to Users > All Users. Filter by Administrator and confirm every name on that list should be there.
What this page cannot tell you
We are not going to claim more certainty than the sources give. This page cannot tell you exactly what a specific plugin sends; only that plugin's documentation, or its author, can. It cannot tell you any provider's current retention or training policy, and we have deliberately not summarized those from memory. The Connectors developer note is silent on whether saving a key sends a test request, so we are silent too.
There is also a timing limit. The Connectors screen and the AI Client are young features, and Make WordPress Core has already published a roadmap for the next release. We will re-verify this page when the next major version ships, and the date at the top will change when we do.
FAQ
Does WordPress send my content to AI automatically after updating to 7.0 or 7.1?
No. According to the AI Client developer note, core does not bundle AI providers, and prompts are sent when a plugin calls the AI Client. Updating WordPress alone does not start sending your posts anywhere.
Is my API key encrypted in the WordPress database?
No. The Connectors API developer note says keys stored in the database "are not encrypted but are masked in the user interface." Storing the key in an environment variable or a PHP constant keeps it out of the database.
Can my visitors' data be sent to an AI provider?
Yes, if a plugin feature processes visitor content such as comments, form entries or search text. That is a plugin design choice, not a WordPress default, and it belongs in your privacy policy.
How do I stop all AI requests from my site?
Deactivate the plugins that use AI features and remove the stored keys from Settings > Connectors. If a key came from an environment variable or wp-config.php, it has to be removed there, usually with your host's help. Revoking the key on the provider's dashboard stops any further use of it.
Written against WordPress 7.1.2. Last verified 2026-09-23.
