SmartDescribe Pro Security, Privacy and API Key Management

Guide 1.12 — Security, Privacy and API Key Management

Product: SmartDescribe Pro
Publisher: Cazgrae
Platform: WordPress and WooCommerce

1. Introduction

SmartDescribe Pro uses AI services to help WooCommerce store owners generate descriptive image alt text.

Depending on the selected AI provider and the features enabled in your installed version, the plugin may communicate with an external AI service using an API key.

Protecting these credentials and understanding how information is processed are important parts of running SmartDescribe Pro securely.

This guide explains how to protect API keys, manage access to plugin settings, monitor usage, and follow sensible security practices.

2. Understanding API Keys

An API key is a credential that allows software to access an external service.

When you connect SmartDescribe Pro to a supported AI provider, the plugin may use your API key to submit requests for image description generation.

The provider uses the key to identify the account making the request and apply the relevant access permissions, usage limits, and billing arrangements.

Why API key security matters

If an unauthorised person obtains your API key, they may be able to use it to make requests against your account, depending on the provider’s restrictions.

This could result in:

  • Unauthorised API usage.
  • Unexpected charges.
  • Exhausted usage quotas.
  • Temporary disruption to your optimisation workflow.
  • Potential exposure of information submitted through unauthorised requests.

Treat API keys as passwords.

3. Obtaining an API Key Safely

Always obtain API credentials directly from the official website of your chosen provider.

Examples include:

Available services, account requirements, and pricing may change.

  1. Sign in to your chosen AI provider.
  2. Open its API key or developer settings.
  3. Create a new key if required.
  4. Copy the key securely.
  5. Open your WordPress administration area.
  6. Navigate to the SmartDescribe settings.
  7. Select the appropriate provider and enter the key in the designated field.
  8. Save the settings.
  9. Use any available connection or API test function to confirm that the configuration works.

The exact menu labels may vary between versions.

Important: Only enter an API key into a plugin installation and website you trust.

4. Protecting Your API Key

Follow these security practices whenever you use SmartDescribe Pro.

Never publish your API key

Do not include API keys in:

  • Website pages or posts.
  • Public code repositories.
  • Support forum posts.
  • Screenshots shared publicly.
  • Emails or messages sent to people who do not need the credential.
  • Documentation intended for customers or the general public.

If you need help diagnosing a connection problem, provide the error message without revealing the key.

Use appropriate account permissions

Limit access to WordPress administrator accounts and plugin settings to people who genuinely need it.

Avoid sharing a single administrator login among multiple staff members. Where possible, give each person an individual account with the minimum permissions required for their work.

Protect your WordPress installation

Keep WordPress, WooCommerce, SmartDescribe Pro, your theme, and other plugins updated.

Use strong passwords and enable two-factor authentication where available.

Remove accounts that no longer need access to your website.

Use HTTPS

Your website should use HTTPS with a valid SSL/TLS certificate.

HTTPS helps protect information transmitted between a visitor’s browser and your website. It does not replace secure plugin configuration, access controls, or API key management.

Be careful with backups and exports

Backups, database exports, and diagnostic files may contain configuration information.

Store them securely, restrict access, and avoid sharing complete database exports when a smaller diagnostic report will do.

5. What to Do if an API Key Is Exposed

If you believe an API key has been disclosed, act promptly.

Step 1: Revoke or disable the exposed key

Sign in to the relevant provider and revoke the compromised credential.

Do not assume that deleting a message or removing the key from a screenshot is sufficient. Someone may already have copied it.

Step 2: Create a replacement

Generate a new API key using the provider’s security controls.

Where supported, apply suitable restrictions to reduce the potential impact of misuse.

Step 3: Update SmartDescribe Pro

Replace the old credential in the plugin’s settings and save the configuration.

Use the available test function, if provided, to confirm that the new key works.

Step 4: Review account usage

Check the provider’s usage dashboard, billing information, and available activity logs.

Look for unusual requests, unexpected usage increases, or charges you cannot explain.

If the key was exposed because a WordPress account or website was compromised, changing the API key alone may not solve the underlying problem.

Investigate the original cause and take appropriate steps to secure the website and affected accounts.

6. Understanding Data Sent to an AI Provider

SmartDescribe Pro needs to send information to an AI service to obtain an AI-generated result.

Depending on the provider and the plugin’s implementation, requests may include image data, image references, prompts, or other information needed to generate alt text.

The precise information transmitted depends on the plugin version, selected provider, and configuration.

Before processing a product catalogue:

  • Review the information contained in the images.
  • Avoid using the plugin to process confidential or sensitive images unless you have confirmed that the processing arrangement is appropriate.
  • Review your AI provider’s privacy policy and data-handling terms.
  • Check any applicable retention, training, and data-processing settings offered by the provider.
  • Consider your legal obligations regarding customer information and privacy.

Do not assume that all AI providers handle submitted information in exactly the same way.

Product images and customer information

Ordinary product photographs may contain little personal information. However, some images can reveal names, addresses, faces, order labels, or other identifying details.

Review images before processing them, particularly if your store contains personalised products or customer-supplied photographs.

Only submit information that is necessary for the intended task.

7. Understanding API Costs and Usage

SmartDescribe Pro may generate requests to an external AI service whenever an optimisation task is run.

Depending on your provider and account, those requests may incur charges or count towards usage limits.

Monitor your usage

Use your AI provider’s dashboard to review usage and billing information.

Where available, configure:

  • Usage notifications.
  • Spending limits.
  • Request quotas.
  • API key restrictions.
  • Project-specific usage controls.

These features depend on the provider and account type.

Reduce unnecessary requests

To avoid unnecessary usage:

  1. Test your settings on a small selection of products.
  2. Avoid repeatedly optimising images that do not need changes.
  3. Review scheduled tasks before enabling them.
  4. Use manageable batches when processing a large catalogue.
  5. Check the results of earlier jobs before launching another run.

Do not assume that every provider charges the same amount or uses the same billing model.

8. WordPress Access and User Permissions

SmartDescribe Pro operates within your WordPress administration environment.

Your website’s security therefore depends partly on how user accounts and administrator permissions are managed.

  • Use individual accounts for staff members.
  • Give users only the permissions they need.
  • Restrict administrator access to trusted personnel.
  • Remove access promptly when a staff member leaves.
  • Keep administrator passwords secure.
  • Enable two-factor authentication where practical.
  • Review active accounts periodically.

The exact capabilities available within SmartDescribe Pro depend on the installed version.

Do not assume that every user role has the same access to plugin settings or optimisation controls.

9. Troubleshooting Security and Connection Problems

Problem: The API key is rejected

Possible causes include:

  • A key was copied incorrectly.
  • The key has been revoked.
  • The selected provider does not match the key.
  • The provider account lacks the necessary access or quota.
  • The provider has changed its API requirements.

Recommended action: Check the provider, verify the key, review account status, and test the connection again.

Never post the full key in a support request.

Problem: API usage has increased unexpectedly

Possible causes include:

  • Repeated optimisation runs.
  • A scheduled job running more frequently than intended.
  • Bulk processing of a larger catalogue.
  • Unauthorised use of the key.

Recommended action: Review usage records, inspect the plugin’s available history or logs, and check your provider account for unusual activity. Revoke the key if you suspect compromise.

Problem: You cannot establish whether information is retained

Retention and training practices vary between providers and account types.

Recommended action: Consult the current terms and privacy documentation for your selected provider. If necessary, contact the provider directly before processing confidential information.

Problem: You suspect your WordPress website has been compromised

Recommended action:

  1. Contact your hosting provider or website security specialist.
  2. Investigate suspicious administrator accounts and recent changes.
  3. Review relevant website and server logs.
  4. Rotate potentially compromised credentials.
  5. Restore from a known-good backup if necessary.
  6. Confirm that the underlying vulnerability has been addressed before resuming normal operation.

For a suspected compromise, do not rely solely on changing the SmartDescribe API key.

10. Security Checklist

Use this checklist when configuring or maintaining SmartDescribe Pro.

  • The API key was obtained from the official provider.
  • The key is stored only in an appropriate, trusted configuration.
  • The key has not been published or shared unnecessarily.
  • WordPress and WooCommerce are kept updated.
  • SmartDescribe Pro is kept updated.
  • Administrator accounts are restricted to trusted users.
  • Strong passwords are used.
  • Two-factor authentication is enabled where available.
  • The website uses HTTPS.
  • API usage and billing are monitored.
  • Backups and diagnostic files are stored securely.
  • The provider’s data-handling terms have been reviewed.
  • There is a process for revoking and replacing exposed credentials.

11. Frequently Asked Security Questions

Does SmartDescribe Pro store my API key?

The exact storage method depends on the plugin’s implementation and configuration. WordPress plugins commonly store settings in the site’s database, but the specific behaviour should be confirmed for your installed version.

Treat the WordPress database and its backups as sensitive resources.

Does Cazgrae control my AI provider’s billing?

API charges, usage limits, and billing arrangements are generally managed by the selected AI provider under the account associated with the API key.

Check the provider’s current terms to understand your costs.

Is my product information automatically private?

Do not assume that all submitted information receives identical treatment from every AI provider.

Review the provider’s privacy and data-processing terms, particularly if your images or product information contain confidential or personal data.

Should I include my API key when requesting support?

No. Never include the full API key in a support request.

Provide the provider name, the general error message, your plugin version, and other relevant non-sensitive details instead.

Does HTTPS make my entire website secure?

No. HTTPS protects data in transit, but it does not by itself prevent compromised administrator accounts, vulnerable plugins, weak passwords, or insecure server configuration.

Use HTTPS alongside regular updates, access controls, secure backups, and sensible credential management.

12. Final Recommendations

SmartDescribe Pro can help streamline image alt text optimisation, but its safe operation depends on appropriate website security and responsible use of external AI services.

The most important practices are:

  1. Protect your API keys as confidential credentials.
  2. Restrict WordPress administration access.
  3. Understand what information is submitted to your selected AI provider.
  4. Monitor API usage and billing.
  5. Keep your website and plugins updated.
  6. Maintain secure backups.
  7. Revoke exposed credentials promptly.
  8. Investigate suspicious activity rather than treating every problem as a simple configuration error.

Security is an ongoing responsibility, not a one-time setup task.

SmartDescribe Pro is a Cazgrae product. Features, settings, and supported AI providers may vary by installed version. Refer to your provider’s current documentation for its specific security, privacy, and billing arrangements.