🔍 Exactly What Gets Hidden, And What Does Not

This is the full, honest picture, straight from how the plugin works. Read it once before your first important recording.

Where masking happens:

• Every wp-admin screen while Privacy Recording Mode is on: WordPress's own screens such as Users, Comments, Profile and the Dashboard, WooCommerce screens, and other plugins' screens.
• Content that loads after the page: live tables, slide-out panels and infinite scroll.
• The browser tab title, so a name in the title of an edit screen is hidden too.
• Only the types of data whose filters you switched on.

The two layers:

1. Before the page leaves your server. Email addresses, IP addresses, phone numbers, prices and visible URLs are swapped here. So are registered users' display names (when Names (any format) or First Names is on), their first and last names (when First Names or Last Names is on) and their usernames (when Usernames is on), recent WooCommerce customers' names and address lines, and cells a plugin marks as a person's name. The real value never reaches your browser.
2. In your browser. Smart Detection, Point & Mask, your custom selectors and the form-field protection run on the page as it appears, including anything that loads later.

Your own name:

In the top admin bar, your own name (the Howdy greeting and the account menu) is hidden whenever a name filter is on, or when Usernames is on. The purple 🔒 Privacy Recording ON badge sits in the same bar.

Form fields:

Text, email, phone and web address fields, and dropdown options that hold personal data, look masked on screen. The form still sends the real value when you save, so saving a user's profile or an order keeps their real email. If you click into a masked field, it empties and shows the mask as a hint. Type a new value and your value is saved. Leave it untouched and the real value is kept. Text areas are blurred rather than masked, and their contents are never changed.

As a further safeguard, if a submitted value is exactly one of the plugin's own masks, it is dropped before anything is saved. That works for admin forms, admin background requests and REST API writes. The plugin's own Settings form is left alone, and fields whose names look like passwords, keys, tokens, licences or nonces are never touched.

What is not hidden:

• Your public website. Masking only runs inside wp-admin. When you view your site while logged in, nothing is masked and there is no badge. Your shop, checkout and account pages are front-end pages, so they are never masked.
• The plugin's own screens under 🔒 Record Privacy, including the email you activated with on the Settings screen. The banner and badge still show there.
• The left admin menu and text inside code blocks.
• Anything you type into a search box while recording. It is shown as you type it.
• Usernames and names shorter than 3 characters. In running text, usernames that are common WordPress words, such as admin, are also left alone. Under a Username column they are masked like any other.
• Web addresses that don't start with http:// or https://, even with Visible URLs on. WordPress shows a commenter's website this way in the Comments list.
• Numbers in a layout the built-in patterns do not recognise, when they sit outside a labelled column or field, for example a phone number with no spaces or dashes in the middle of a sentence. Under a heading such as Total, Phone or Postcode, and when you pick them with Point & Mask, they are hidden whatever their layout.
• Very large pages. If a page's code is over 2MB (for example an unpaginated list of thousands of users), the server layer skips it to protect performance. The browser layer still runs. Keep long lists paginated.
• Files and exports. Anything that is not a web page, such as a CSV export or a download you start from wp-admin, is left exactly as it is, so the file holds real data.
• A brief moment. Content that loads after the page is masked a fraction of a second after it appears. Give each screen a moment before you talk over it.
• The Blurred style. The real text is still in the page, only blurred.
• Anything outside the WordPress page: your browser's address bar, bookmarks bar, other tabs and windows, and desktop notifications. Link addresses shown when you hover over a link, including email links, are not rewritten.
• Text inside pictures. Words in images, screenshots or PDFs you have uploaded are not changed.
• Everything outside the screen. Emails WordPress sends, your database and your recordings themselves are never changed.

Make real changes with the switch off:

Even though saving is safe, the easiest habit is to record first, turn the switch off, then make your changes, so you can see the real data while you edit.

The switch covers everyone:

Privacy Recording Mode is site-wide. While it is on, every person working in wp-admin on the site sees masked data, not just you.

Where to go from here:

Users, Comments And Profiles With The Switch On shows WordPress's own screens with masking on, and Recording Workflow: Before, During And After turns this list into a checklist.