This is the full, honest picture, straight from how the plugin works. Read it once before your first important recording.
Where masking happens:
- Every wp-admin screen while Privacy Recording Mode is on: WordPress's own screens such as Users, Comments and the Dashboard, WooCommerce screens, and other plugins' screens.
- Content that loads after the page: live tables, slide-out panels and infinite scroll.
- Only the types of data whose filters you switched on.
The two layers:
- Before the page leaves your server. Email addresses, IP addresses, phone numbers, prices and visible URLs are swapped here. So are registered users' names and usernames (when First Names, Last Names or Usernames is on), recent WooCommerce customers' names and address lines, and cells a plugin marks as a person's name. The real value never reaches your browser.
- In your browser. Smart Detection, Point & Mask, your custom selectors and the form-field protection run on the page as it appears, including anything that loads later.
What is not hidden:
- Your public website. Masking only runs inside wp-admin. When you view your site while logged in, nothing is masked and there is no badge. Your shop, checkout and account pages are front-end pages, so they are never masked.
- The plugin's own screens under 🔒 Record Privacy, including the email you activated with on the Settings screen.
- The left admin menu. In the top admin bar, your own name (the greeting and the account menu) is hidden whenever a name filter is on, or when Usernames is on.
- Text inside code blocks. Anything you type into a search box while recording is shown as you type it.
- Usernames and names shorter than 3 characters, and usernames that are common WordPress words, such as admin.
- Numbers in a layout the built-in patterns do not recognise, when they sit outside a labelled column or field, for example a phone number with no spaces or dashes in the middle of a sentence. Under a heading such as Total, Phone or Postcode, and when you pick them with Point & Mask, they are hidden whatever their layout.
- Very large pages. If a page's code is over 2MB (for example an unpaginated list of thousands of users), the server layer skips it to protect performance. The browser layer still runs. Keep long lists paginated.
- A brief flash. Content that loads after the page is masked a fraction of a second after it appears. Give each screen a moment before you talk over it.
- The Blurred style. The real text is still in the page, only blurred.
- Anything outside the WordPress page: your browser's address bar, bookmarks bar, other tabs and windows, and desktop notifications. Link addresses shown when you hover over a link, including email links, are not rewritten.
- Text inside pictures. Words in images, screenshots or PDFs you have uploaded are not changed.
- Everything outside the screen. Emails WordPress sends, your database and your recordings themselves are never changed.
Form fields:
Text, email, phone and web address fields, and dropdown options that hold personal data, look masked on screen. The form still sends the real value when you save, so saving a user's profile or an order keeps their real email. If you click into a masked field, it empties and shows the mask as a hint. Type a new value and your value is saved. Leave it untouched and the real value is kept. Text areas are blurred rather than masked, and their contents are never changed. As a further safeguard, if a submitted value is exactly one of the plugin's own masks, it is dropped before anything is saved.
Make real changes with the switch off:
Even so, the easiest habit is to record first, turn the switch off, then make your changes, so you can see the real data while you edit.
The switch covers everyone:
Privacy Recording Mode is site-wide. While it is on, every person working in wp-admin on the site sees masked data, not just you.