AI, rules, and security controls
Check AI switches and requests, rule triggers, phishing policies, locks, and logs.
Check feature availability and configuration before changing provider credentials. AI, auto-tagging, and phishing reports are paid features. Email rules, the mailbox lock, and core rendering protections are available in Free.
AI controls are absent or disabled
Confirm the installed edition and license, then ask an administrator to review the AI configuration and the individual feature toggle.
AI needs the site-wide Enable AI features switch on, and each feature needs its own switch. There is no separate acceptance step, apart from one confirmation when you switch on checks of every user's new mail with your own provider. Follow Set up and use AI to check both, and the provider settings.
A provider request fails
Check the endpoint, model, saved key, and the provider's response. Authentication errors, rate limits, unsupported models, and network timeouts are different failures.
The WordPress server must reach the endpoint. Opening it from your browser is not enough. Do not paste API keys into support reports or browser consoles.
Configured means settings were saved; it is not a successful request. Run a controlled test after the correction.
Auto-tagging does nothing
Confirm the feature is enabled, tagging instructions are saved, and WP-Cron is running. The queue processes up to five items per run, with separate classification calls. A busy queue or provider rate limit can delay tags.
AI tags cannot be used as a deterministic rule condition in the checked runner.
A rule does nothing or changes too much
Check whether its trigger is Manual, When mail arrives, or On a schedule. New ordinary rules default to Manual. Check account scope, condition logic, priority, and stop processing.
The runner does not support body or size conditions, or Apply label, forward, skip inbox, and never spam actions. Upgrading does not remove those limits.
Run rules now is a mutating action, not a preview. Disable a misbehaving rule to stop future runs, then inspect affected messages at the provider. Disabling it does not undo moves or deletions. See Email rules.
A phishing report is incomplete
The site policy can allow manual checks, force scanning on open, or disable the control. Missing authentication headers and failed AI analysis can produce skipped or partial results.
A partial report can still contain local evidence. An absent warning does not prove a message is safe. See Phishing reports.
Lock, images, or history behave unexpectedly
Clearing browser cookies removes that browser's lock grant. Unlock again or follow the lock recovery instructions.
An administrator's external-image restriction can override personal preferences. Paid proxying also depends on configuration; Free revealed images use direct HTTPS.
The paid audit history is separate from the WordPress delivery log. Check the correct log and retention setting before assuming an event is missing. Email safety and audit history explains the distinction.