Filters Reference

Filters Reference

Three filters, all of them about controlling who may call what and how often. There are no filters for the prompt, the widget markup, or the question content.

---

ai_fq_rate_limit

Adjusts how many requests a bucket allows per 60-second window.

apply_filters( 'ai_fq_rate_limit', int $limit, string $bucket );

Argument
$limit	The default for this bucket: 5 for per-visitor buckets, 15 for the per-IP ceiling
$bucket	The bucket key, prefixed generate|, generate-ip| or answer|

add_filter( 'ai_fq_rate_limit', function ( $limit, $bucket ) {
    if ( str_starts_with( $bucket, 'generate-ip|' ) ) {
        return 40;
    }
    if ( str_starts_with( $bucket, 'generate|' ) ) {
        return 10;
    }
    return $limit;
}, 10, 2 );

Zero and negative returns are ignored and the default for that bucket applies. The rate limiter is the only cap on a public endpoint's cost, so a typo cannot switch it off. There is no upper bound.

Match on the prefix, not the whole string — the rest of the bucket key is a hash.

---

ai_fq_client_ip

Sets which address the plugin treats as the visitor's, for both rate limiting and the reveal binding.

apply_filters( 'ai_fq_client_ip', string $ip );

Defaults to REMOTE_ADDR. Returning an empty string falls back to unknown.

add_filter( 'ai_fq_client_ip', function ( $ip ) {
    if ( ! empty( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) {
        return sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) );
    }
    return $ip;
} );

Only trust a header a proxy you control actually sets. Forwarded headers are client-supplied; trusting one on a site that is not behind that proxy gives every caller a fresh rate-limit identity per request. Background: Running Behind Cloudflare or a CDN.

---

ai_fq_allowed_ollama_hosts

The list of hosts the Ollama provider may call.

apply_filters( 'ai_fq_allowed_ollama_hosts', array $hosts );

Defaults to localhost, 127.0.0.1, ::1. Hosts are compared lower-cased with IPv6 brackets stripped, so add ::1-style entries unbracketed.

add_filter( 'ai_fq_allowed_ollama_hosts', function ( $hosts ) {
    $hosts[] = '10.0.0.42';
    return $hosts;
} );

---

ai_fq_allow_remote_ollama

The escape hatch when the allowlist is not enough.

apply_filters( 'ai_fq_allow_remote_ollama', bool $allowed, string $host );

Defaults to false. Consulted only when the host is not already on the allowlist.

add_filter( 'ai_fq_allow_remote_ollama', function ( $allowed, $host ) {
    return str_ends_with( $host, '.internal.example.com' );
}, 10, 2 );

Returning true unconditionally permits server-side requests to whatever URL is in the Ollama field. Prefer ai_fq_allowed_ollama_hosts where you can name the hosts.

Ollama does not use wp_http_validate_url() because that helper rejects loopback and private addresses — exactly where a self-hosted Ollama lives. These two filters are the SSRF boundary in its place.

---

Constants

Not filters, but the other supported extension point:

Constant	Effect
AI_FQ_OPENAI_KEY	Overrides the stored OpenAI-compatible key
AI_FQ_HF_TOKEN	Overrides the stored Hugging Face token

Both take priority over the database, and the settings screen shows a notice when one is set. See Keeping API Keys Out of the Database.

What is not filterable

The prompt, the topic and angle lists, the content length caps, the ten-minute question lifetime, the 60-second rate-limit window, and the widget markup. Changing any of those means editing the plugin.