Security
- The license key can stay out of the database, in
wp-config.php(see License, plans and updates). - The panel always shows the key masked.
- Only administrators (
manage_options) can access the panel and recording mode. - The dictionaries are PHP files inside
uploads/. The plugin creates a protectiveindex.phpand.htaccessthere, but on servers that run PHP insideuploads/that is not enough (on Nginx the.htaccesshas no effect). If your host allows it, block PHP execution in that folder.
Known limitations
- Custom routes keep their original word. A route a theme or plugin creates without a page behind it keeps its original word after the prefix. It still works. Everything else gets a translated address.
- Emails not tied to an order may go out in the store’s language. An email to the customer that is not linked to an order has nowhere to inherit the language from. (Order emails go out in the language of the purchase — see WooCommerce.)
- One sentence, one translation, across the whole site. The Where column helps give context to whoever reviews.
- It does not translate inside
<script>, except the JSON-LD structured data (see SEO: hreflang, sitemaps and canonical). The rest is code. - Builder text that was never read shows once in the source language. On content made before version 0.9.0 that nobody has saved since, the page is read when someone opens it translated: that first visitor sees the builder’s text untranslated, and the next ones do not.
- Headers and footers made in a page builder are read in the weekly check or with Translate the site, not right after they are saved.
- Text the page only shows after loading, through JavaScript, is not read.