LinkTiller

The LinkTiller safety contract

A plain-language record of what the plugin may read, what may leave WordPress, what must pass before a write, and what Undo can promise.

Nothing leaves WordPress during the scan.

The first scan reads selected published content and builds an incoming-link map inside WordPress. It does not call Sai Studios, your configured model, or a third-party analytics service.

A model request happens only when an administrator tests the configured connection or asks for source opportunities for one target page.

What the configured endpoint receives.

  • The selected target ID, URL, title, and up to 2,000 characters of plain-text content.
  • Up to 40 locally ranked source IDs, titles, and excerpts of up to 700 characters.
  • The model name selected in LinkTiller settings.
  • An Authorization header only when the operator configured an API key.

Requests go directly from the WordPress server to the configured Base URL. Sai Studios does not relay, inspect, or store them. Provider retention and privacy terms still apply.

Six checks stand between a proposal and a write.

Administrator intent
A user with the required WordPress capability must request opportunities and approve a specific insertion.
Selected content
The source and target must still be published records from a content type selected in LinkTiller settings.
Exact phrase
The proposed 2-6 word anchor must still exist as editable text in the source. Rewritten or invented anchors fail.
Real destination
The target must resolve to the selected on-site post or page, and the source must not already link to it.
Fresh source
The current stored source content must match the SHA-256 snapshot that LinkTiller verified when it displayed the opportunity.
Safe placement
The phrase must be outside links, headings, code, forms, navigation, and other protected DOM contexts.

One insertion gets one receipt.

LinkTiller tags the inserted anchor, saves through WordPress, and confirms that the marker survived save processing before reporting success. The receipt records the source, target, anchor, and hashes needed for recovery. It does not claim that the link improved rankings.

Exact Undo

If the stored content still matches the approved result, Undo restores the exact content WordPress held before that insertion.

Surgical Undo

If later edits exist and the tagged LinkTiller anchor is still present, Undo removes only that link while keeping the later work. If the marker is missing or the state is ambiguous, LinkTiller refuses to guess.

What has been proved, and what has not.

Build proof
v0.3.2 produced the same package hash twice and passed the WordPress 7.1 smoke suite.
Directory checks
Plugin Check 2.1.0 reported no errors for the staged candidate.
Browser proof
A real provider-backed run inserted receipt 8820c9b5, restored the exact content, and refused a deliberately stale source before writing.
Still unproved
No external pilot, ranking lift, time saving, retention, or adoption result has been established. v0.3.2 is not a public WordPress.org release.

The operator still owns the judgment.

Use a current backup or staging environment. Review the source sentence and resulting page. Check custom post types and page builders before assuming their storage model is safe. Keep provider credentials out of pilot notes and support messages.

Apply for the five-site pilot