What the plugin actually does on your server #
The Loupely WordPress Plugin adds a logging layer that records PHP Errors, Hook Execution events, and WooCommerce pipeline events to a local database table. It registers a REST API Endpoint that the Chrome extension uses to retrieve this data when you initiate a capture. That endpoint is authenticated using the connection key. Nothing else happens. The plugin does not make outbound requests to Loupely’s servers on its own, does not run on a cron schedule, and does not phone home in the background.
The REST API Endpoint #
The plugin creates a single authenticated REST endpoint at /wp-json/loupely/v1/capture. Requests to this endpoint require the connection key in the request header. Without the key, the endpoint returns a 401 and provides nothing. The key itself is a long random string generated at plugin activation. It is not derived from your WordPress credentials and has no privileges in WordPress beyond allowing the extension to read the capture data.
The endpoint is read-only. It returns diagnostic data. It cannot write to your WordPress installation, modify settings, install plugins, or execute arbitrary code.
Database footprint #
The plugin creates one database table: wp_loupely_events (using your WordPress table prefix). This table stores the rolling diagnostic log: PHP error entries, Hook Execution records, and WooCommerce pipeline events. The table is bounded by the retention window configured in the plugin settings (default 30 days). Older entries are pruned on each page load.
The table contains only diagnostic data, not customer data. WooCommerce pipeline events record whether pipeline stages completed, not order contents or customer information.
File permissions and plugin integrity #
The plugin files should have 644 permissions, matching standard WordPress Plugin requirements. No plugin files need to be writable at runtime. If a security scanner flags the Loupely plugin files, verify the permissions match 644 and that the plugin was installed from useloupely.com or through your account. Do not install Loupely from unofficial sources.