Aimogen ProDocumentation
Product page Support

Production hardening checklist

A checklist to work through before Aimogen Pro faces real traffic, covering spend, access, exposure and data.

Work through this before the plugin is reachable by anyone you do not control.

Spend#

  • [ ] A monthly spend cap in every provider dashboard. The only control nothing on your site can bypass.
  • [ ] Enable Global Usage Limits on, with Max Guest Credits set. See Usage limits.
  • [ ] A separate text-to-speech limit, if speech is enabled. It is billed per character.
  • [ ] Chatbot rate limiting — around ten messages per minute.
  • [ ] user_token_cap_per_day on any front-end generator shortcode.
  • [ ] Rules start at one post per run until you have seen the cost per post.
  • [ ] Max Steps on agents kept low.
  • [ ] Usage tracking on, so you can see what is happening.

Access#

  • [ ] access_aiomatic_menu granted only to trusted roles. It is an administrative privilege.
  • [ ] Menu restrictions hiding Playground, Agents, Settings, Snippets and MCP from non-administrators.
  • [ ] No unnecessary manage_options accounts.
  • [ ] Strong passwords and two-factor on every administrator account. They can read your API keys.

Exposure#

  • [ ] REST API off unless used. If on, API keys or bearer tokens set — an empty key list makes it public.
  • [ ] Webhooks off unless used. If on, long random secrets.
  • [ ] MCP server off unless used. If on, a long random bearer token and only the capability groups you need.
  • [ ] Remote chatbot domain allowlist set, if remote embedding is enabled.
  • [ ] HTTPS everywhere. Required for microphone access, and everything else.

AI actions#

  • [ ] God Mode off. If you must use it, whitelist specific functions, never the blacklist alone, and never on a public chatbot.
  • [ ] Database access SELECT only.
  • [ ] No social publishing extensions on a public chatbot.
  • [ ] Agent tool sets minimal. Add the fifth tool only when demonstrably needed.
  • [ ] No agent combining broad ingestion with high-impact actions. See Agent security.
  • [ ] OmniBlock List Allowed For The AI To Execute set to an explicit allowlist.
  • [ ] Strip JavaScript From Chatbot HTML Responses on. No exceptions.

Data#

  • [ ] Enable Detailed Usage Tracking off in production.
  • [ ] Provider retention off if you process personal data.
  • [ ] Retention set on conversations, uploads and logs.
  • [ ] Auto Clear Logs scheduled.
  • [ ] GDPR consent gate if you are in scope.
  • [ ] Chat Compliance Text stating that responses are AI-generated and asking visitors not to send sensitive information.
  • [ ] Privacy policy updated to describe the AI processing.

Reliability#

  • [ ] Reliability Mode on, with a fallback list including a second provider.
  • [ ] Smart API-key rotation on, with more than one key where volume justifies it.
  • [ ] A real cron trigger, with DISABLE_WP_CRON set. See Recommended server configuration.
  • [ ] PHP limits raised — max_execution_time 300, memory_limit 256M, max_input_vars 5000.
  • [ ] Provider domains reachable from the server.
  • [ ] Backups including the database, tested.

Content#

  • [ ] New rules publish drafts for the first day.
  • [ ] Someone reads the output. Regularly, not once.
  • [ ] Affiliate and AI disclosures in the prepend field where required.
  • [ ] No invented reviews, testimonials or product claims on live pages.
  • [ ] Prompts instruct against invention where accuracy matters.

After going live#

First day. Read every generated post. Check Activity Logs and Usage Logs.

First week. Compare actual cost against your estimate. Read chatbot conversations — they will show you what your knowledge base is missing.

Monthly. Review usage graphs, error patterns, log table sizes and licence status.

After every plugin update. Check that model selections are still valid, run one rule manually, and re-check cron. See Updating Aimogen Pro.

Incident response#

If a key leaks: revoke it at the provider immediately, generate a new one, update the setting, check Usage Logs for unauthorised use.

If a public endpoint is abused: set Max Guest Credits to zero, block the IP, check the extent in Usage Logs, then re-open with limits in place.

If an agent did something wrong: cancel its schedule, read the execution log in aiomatic_agent_runs, restore from backup if needed, narrow its tools before running it again.

If the site breaks after a snippet: add define( 'AIMOGEN_DISABLE_SNIPPETS', true ); to wp-config.php. See AI Snippets Engine.

Still stuck? Open a support ticket and include the diagnostics from Aimogen Pro › System & Logs › System Info.