AI Blog Writer with Sources

Trust

Security and privacy

The plugin runs inside your WordPress site, on your own AI account. There is no account with us, and nothing is sent anywhere until you add a key or supply a URL.

At a glance

  • Your API keys stay on your server, encrypted, and never reach the browser.
  • Content goes only to the AI provider you chose, and only when a job or a tool you start needs it.
  • Jobs, sources and drafts are stored in your own database, with a retention limit you set.
  • Usage data for the plugin's author is off by default and contains no content.
  • Nothing is ever published automatically.

Your API keys

Keys are used only in server-side requests. They are never sent to the browser or returned by the REST API, and the settings screen never shows a saved key again. Saved keys are encrypted with Sodium, using AIBCG_ENCRYPTION_KEY or, if you don't define one, the WordPress AUTH_KEY. To keep a key out of the database altogether, define it in wp-config.php instead, for example AIBCG_OPENAI_API_KEY. See AI providers and API keys.

What leaves your site

  • Your AI provider (OpenAI, Anthropic, Google or xAI) receives the brief, the writer profile, and notes from the selected sources when a job runs, or what a tool you click needs, such as a section to rewrite. Never WordPress credentials, other database contents, or visitor data.
  • The source URLs you supply are fetched by your server with a plain request that identifies the plugin and your site. No brief content, key or user data is sent to them.
  • Usage data, only if an administrator turns it on: anonymous counts and settings, such as which provider is used and whether drafts finish. Never your site address, names, keys, or anything written in the plugin. Diagnostics shows exactly what is waiting to be sent, and can delete what was sent.

AI Blog Writer Pro also sends search queries written from your brief to Tavily, with your own Tavily key, and your site URL to Freemius when you activate a license. The full list, with each endpoint and when it is called, is in Privacy and external services.

What stays on your site

Jobs, briefs, sources and their extracted notes, outlines, drafts, usage, and writer profiles are stored in your WordPress database. A daily task deletes the sources, notes, outlines, draft versions and stored brief of each completed job after the retention period you set (90 days by default); generated posts are always kept. WordPress's Export Personal Data and Erase Personal Data tools cover the plugin's data. Uninstalling removes the plugin's capabilities and usage data settings, and, if you define AIBCG_REMOVE_DATA_ON_UNINSTALL, all its tables, options and keys.

Who can use it

Administrators manage keys and settings. Editors can create drafts and manage every job; authors create and manage their own. Other roles can't use the plugin.

Fetching sources safely

Source URLs must be public web addresses: private and local network addresses are rejected, redirects are limited to three, and each page is capped at 1 MB. Only HTML and plain-text pages are read.

You stay in control of publishing

Every result is a WordPress draft. The plugin never publishes, schedules or changes a published post on its own, and replacing a section keeps the previous version in Revisions.

Open source

The plugin is free software under the GPL. Its full source code is public in the WordPress.org plugin repository, and it was reviewed by the WordPress.org plugin team before it was listed.

Reporting a security problem

If you find a vulnerability, please email info@sourcedwriter.com rather than posting it in the public support forum. Include the plugin version and the steps to reproduce it. You'll get a reply, and a fix is released as soon as it's ready, with credit if you want it.

For how this website itself handles data, see the website privacy policy.