The WPMC Behavior & Heatmap plugin is designed with strict attention to security, data integrity, and user privacy. Every part of the system — from data tracking to admin management — includes safeguards to prevent unauthorized access, malicious data injection, and accidental data loss.

1. Secure Access Control

Capability Checks:

All admin functions and AJAX endpoints use WordPress capability checks (current_user_can('manage_options') or specific capability checks for non-admin actions). This ensures only authorized users can view or modify tracking data.

Nonce Verification:

Actions such as data cleaning, heatmap loading, and AJAX operations are protected with WordPress nonces (wp_verify_nonce()). Nonces prevent Cross-Site Request Forgery (CSRF) attacks, ensuring that only legitimate admin requests are processed.

2. Data Sanitization & Validation

Input Sanitization:

All incoming data from $_POST and $_GET is sanitized using functions such as:

• sanitize_text_field() — for plain text.
• intval() — for numeric values.
• sanitize_key() — for keys or identifiers.

Output Escaping:

Data is escaped before being output in HTML using:

• esc_html() — for plain text.
• esc_attr() — for attributes.
• esc_url() — for URLs.

Strict Database Queries:

All custom SQL queries use $wpdb->prepare() to prevent SQL injection. This ensures that even if a malicious actor tries to manipulate query parameters, they cannot execute arbitrary SQL.

3. Privacy by Design

No Personal Identifiable Information (PII) by Default:

The plugin does not track sensitive personal details like names, emails, or exact addresses of users unless explicitly customized to do so. It focuses on anonymous behavior analytics — clicks, scrolls, navigation paths.

Data Retention Controls:

The Cleaning tab allows you to:

• Delete specific tracking tables.
• Remove data for a given time period.
• Keep the database lean and avoid storing outdated or unnecessary information.

4. Secure Script & Asset Loading

• Versioned Script Loading: JavaScript and CSS assets are loaded with version parameters to avoid cache-related injection risks.
• Scoped Loading: Frontend tracking scripts are injected only when needed, reducing the surface for malicious code execution.

5. Controlled Heatmap Access

Heatmap pages (including iframes) validate:

• Page IDs via sanitization.
• Admin permissions before showing behavior data.

Direct access to heatmap rendering scripts without authentication is blocked.

6. Theme & UI Settings Security

The UI Theme Switcher saves preferences using:

• Sanitization of the wpmc_ui_theme value.
• Capability checks to ensure only permitted users change the appearance.

7. AJAX Security

Each AJAX action:

• Is registered with a specific action hook (e.g., wp_ajax_...).
• Checks current_user_can() before executing.
• Verifies a nonce.
• Sanitizes all incoming parameters before processing.

8. Protection Against Data Loss

The plugin does not delete tracking data unless explicitly requested in the Cleaning tab. Bulk deletions require admin confirmation and nonce validation to prevent accidental loss.

9. Compatibility with Security Plugins

Fully compatible with WordPress security plugins such as Wordfence, iThemes Security, or Sucuri. Respects site-level security rules for login, file editing, and database access.