Silver Tier Setup — WP Luminary

Silver tier routes all scan requests through the LittleBig proxy worker (wp-luminary-proxy). The AI prompt is owned entirely server-side — it is never exposed in the plugin or visible in your Anthropic account.

What changes vs Bronze

Aspect	Bronze	Silver
Endpoint	api.anthropic.com	littlebig-wp-luminary-proxy.andredaus.workers.dev
Auth	Your Anthropic API key	Your license key (sent in request body)
Prompt	Defined in plugin code	Defined on the server; never in plugin
Response	Streamed SSE	Structured JSON { risk_level, status, summary, findings, patterns, tokens }

Prerequisites

• WP Luminary plugin installed and activated
• A Silver or Gold license key
• No Anthropic API key required

Setup steps

1. In WordPress admin, go to WP Luminary → Settings.
2. Enter your Silver license key under License Key and click Activate.
3. The plugin detects your tier as silver from the license server response.
4. You can leave the Anthropic API Key field empty — Silver does not use it.
5. Run a scan from WP Luminary → Scan to verify.

Verifying Silver mode is active

In the scan results panel, a badge reading Silver appears next to the tier indicator. You can also check WP Luminary → Settings — the API key field is marked as not required when a Silver or Gold key is active.

Dynamic scan config

Silver and Gold installs pull a scan configuration from the proxy every 24 hours. This lets LittleBig push new detection patterns (file extensions, regex rules, batch sizes) without requiring a plugin update.

The config is cached in your WordPress options table under wpl_scan_config. It refreshes automatically when the cache expires.

Deactivating your license

To move a license to a different domain or stop using WP Luminary on a site:

1. Go to WP Luminary → Settings.
2. Next to your active license key, click Deactivate.
3. Confirm the prompt — this releases the domain seat on the license server immediately.
4. The license key is removed from the site and the transient cache is cleared.

After deactivation the plugin falls back to unlicensed state. An admin notice will appear reminding you to add a key. You can then activate the same license key on a different domain.

Threat telemetry

When a scan finds suspicious or flagged content, the proxy logs anonymized telemetry to the LittleBig threat intelligence database. No PII is collected. Specifically:

• No domain name
• No IP address
• No file content
• No database option values
• No full file paths

What is logged: plugin slug and version (extracted from path pattern), WordPress major.minor version, file extension, detected patterns, risk level, and date (day only).

This data powers the public /v1/threat-feed endpoint and future WAF integrations (CrowdSec, ModSecurity, Cloudflare custom rules).