01

About the plugin

When a reader selects text in one of your posts and copies it, the plugin records what was copied, from which post and when, and tells the site administrator by email. Over time you see which passages people take.

• It does not stop copying. No right-click or selection blocking. Readers select, copy and right-click as usual.
• Log: date, post, copied text, shortened IP address and browser in one list. Filter by post; delete selected entries or all of them.
• Email: one summary per hour (the default) or one email per copy, with an hourly cap. Plain text only.
• Narrow by default: 20 characters or more, from the post body only, on posts and pages only. Copies by logged-in administrators and editors are ignored.
• No outside services. Reports go only to your own site and email goes out through WordPress’s own mail function. No cookies, and nothing stored in the visitor’s browser; only a one-way hash of the IP address is kept for up to an hour, for the rate limits. (An add-on such as Pro can send notifications to services you switch on; it then says so in the suggested privacy policy text.)
• Old records go away. By default, records older than 90 days are deleted once a day.

From copy to log entry

1. On the single view of a monitored post, a reader copies text from the post body.
2. A small script on the page checks the length and where the selection is. If it qualifies, the script sends the text (up to 500 characters) and the post ID to your site’s REST API at /wp-json/rapls-copy-notice/v1/log.
3. Your site checks the rate limits, that the post is published and monitored, and whether the IP address or post is ignored, then stores one row in the plugin’s own table.
4. In summary mode the email goes out with the next hourly run; in instant mode it goes out straight away.

02

Requirements

03

Installing and a first test

1. In the admin, go to Plugins → Add New and search for “Rapls Copy Notice”.
2. Click Install Now, then Activate.
3. That’s it. You do not need to save any settings first.

Straight after activation the plugin:

• logs copies of 20 or more characters from the body of posts and pages;
• sends one summary per hour to the site administration email address (Settings → General);
• ignores copies by logged-in administrators and editors;
• shortens IP addresses before storing them and deletes records after 90 days.

Check that it works

1. Open a published post in a private (incognito) browser window. While you are logged in, your copies are not counted.
2. Select at least 20 characters of the post body and copy them.
3. Open Tools → Rapls Copy Notice. The Log tab has a new row.
4. The email arrives with the next hourly run. To see one sooner, switch the Notifications tab to “One email per copy, right away” and copy again.

04

The admin screen

Everything is on one page, Tools → Rapls Copy Notice, with tabs along the top. Users with the manage_options capability (normally administrators) can open it.

Each tab is saved on its own. Save Changes saves only that tab’s fields and shows “Settings saved.” A number outside the allowed range is moved to the nearest limit; anything that is not a number goes back to the default.

On the Plugins screen, the plugin’s row also has Log and Settings links (Settings opens the Notifications tab).

05

The Log tab

Columns

An empty log shows “No copies recorded yet.”

Filter by post

Pick a post in the All posts drop-down above the list and click Filter. The drop-down lists the posts that appear in the log, most copied first (up to 200). Show only this post in the Post column does the same.

Copies of this paragraph

Each copy also records a fingerprint of the paragraph it started in: a SHA-1 hash of that paragraph’s text, worked out in the reader’s browser. The paragraph itself is not stored. Copies of this paragraph lists only the copies taken from the same paragraph of the same post. The list then says “Showing one paragraph only.”; Show all paragraphs takes you back.

• These count as paragraphs inside the post body: p, li, blockquote, pre, headings (h1–h6), table cells, dt/dd and figcaption.
• Change one character of a paragraph and it counts as a different paragraph.
• Browsers offer the hashing function only on HTTPS pages, so sites on plain HTTP don’t get this link. Copies are still logged over HTTP.

Deleting entries

• Selected entries: tick the checkboxes, choose Delete under Bulk actions and click Apply. The screen says “N entries deleted.”
• Everything: Delete all entries below the list. Confirm the dialog (“Delete every log entry? This cannot be undone.”) and every entry is removed. There is no undo.

Change the number of rows per page under Screen Options at the top right (default 20, 1–200).

06

The Notifications tab

How the hourly summary works

• The hourly run is a WP-Cron event. WP-Cron runs when the site gets a visit, so on a quiet site the summary goes out with the first visit after the hour, not on the hour.
• If there is nothing new, no email is sent.
• One email lists up to 100 entries in full. Anything beyond that is counted: “…and N more. See the log screen for all of them.” One run covers up to 5,000 entries.
• Entries whose email could not be sent are not marked as notified, so the next summary tries again.

07

Notification emails

Emails are always plain text (text/plain; charset=UTF-8), never HTML. The subject is made only of the site name, your Email subject words and a count. Post titles and copied text never go in it.

---------------------------------------------------
It appears that the following text was copied.
---------------------------------------------------

> Rinse the paper filter with hot water before you start brewing.

Date: October 9, 2026 3:14 pm
Post: Pour-over coffee basics
URL: https://example.com/pour-over/
Length: 63 characters
IP: 203.0.113.0
Browser: Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1
Referrer: www.google.com
---------------------------------------------------

> Let the grounds bloom for about 30 seconds before the next pour.

Date: October 9, 2026 3:40 pm
Post: Pour-over coffee basics
URL: https://example.com/pour-over/
Length: 64 characters
IP: 2001:db8:85a3::
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
---------------------------------------------------

Log: https://example.com/wp-admin/tools.php?page=rapls-copy-notice
Settings: https://example.com/wp-admin/tools.php?page=rapls-copy-notice&tab=notifications

A sample hourly summary. Instant emails look the same, with one entry each. The fixed wording follows the site language once a translation is available.

08

The Detection tab

What counts and what doesn’t

• A copy counts only when the whole selection is inside the content area (Content area, or the parent of the Find the post body marker). A selection that runs from the body into the sidebar does not count.
• Copying the same text again within 10 seconds is not reported a second time.
• The site accepts reports only for published posts of a monitored type. Drafts and previews don’t count.
• Reports from an ignored IP address or for an ignored post are dropped quietly, with the same response as a stored one.

When to turn on Find the post body

Use it when your theme wraps the post body in none of .entry-content, .post-content or article, or when article also contains the comments and the area is too wide. When it is on, monitored pages get this element at the end of the post body:

<span class="rapls-cn-content-marker" hidden></span>

It is added only to the body of the post being viewed, inside the main loop. Excerpts, widgets and feeds are left alone. If your theme already uses one of the selectors above, leave it off.

09

The Privacy tab

Examples of shortening: 203.0.113.45 → 203.0.113.0, 2001:db8:85a3:1:2:3:4:5 → 2001:db8:85a3::. Changing the setting does not rewrite records already stored.

Suggested privacy policy text

The plugin adds three paragraphs to the privacy policy guide. In short:

• When someone copies text from a post, the site records what was copied (up to 500 characters), the length of the selection, which post, the date and time, the browser’s user agent, the host name of the referring page and the IP address, which is shortened by default before storage.
• The information is used to tell the administrator by email which content is being copied. The email goes through the site’s mail system, which may be an outside email provider; otherwise it is not shared with anyone or sent to any outside service. No cookie or identifier is stored in the browser, and a one-way hash of the IP address is kept for up to an hour to limit abusive requests.
• Copy records are deleted automatically after N days (N is your Keep records for value).

If you turn IP shortening off, or use the features on the Visitors tab, edit the text to match what your site actually does.

10

The Visitors tab

These features act on the reader’s side when they copy. Both are off by default; until you turn them on, readers see nothing.

With Source link on, this is what lands on the reader’s clipboard:

Rinse the paper filter with hot water before you start brewing.

Source: Pour-over coffee basics

https://example.com/pour-over/
example.com

Pasted into an editor that keeps formatting, the copied text keeps its formatting and ends with one line linking to the post.

11

Dashboard widget

The admin Dashboard gets a “Rapls Copy Notice” widget, visible to users with the manage_options capability.

• The number of copies in the last 7 days (for example “12 copies in the last 7 days”).
• Most copied posts: the top three posts of the last 7 days, each with its count. A post title opens the log filtered to that post.
• View the log: a link to the Log tab.

The widget shows post titles only, never copied text. To hide it, use Screen Options on the Dashboard.

12

Site Health

The plugin adds four checks to Tools → Site Health → Status. They look only at the site’s own state and make no outside requests. When something needs attention, the result links to the right place (Open the settings).

The IP check looks at your own request when you open Site Health. It warns when a forwarding header is present and either the direct connection comes from a private address or a Cloudflare header is present. Header values are neither used nor shown.

Info tab

Site Health’s Info tab gets a “Rapls Copy Notice” section. When you ask for support, copy and paste it; it explains the setup quickly and contains no visitor data.

Fields: Version / Database schema / Records stored / Records in the last 7 days / Notification mode (digest or instant) / Next summary check / Monitored post types / Rate limits / Trusted proxies (how many) / IP addresses shortened / Retention (days) / Rate-limit counters stored in / Message / source link for readers.

13

How visitor data is handled

Everything in a copy report comes from the visitor’s browser, so the plugin treats all of it as untrusted.

What is stored

Each copy is one row in the plugin’s own table ({prefix}rapls_cn_log): date and time (UTC), post ID, copied text (up to 500 characters), the length of the original selection, IP address, user agent (up to 255 characters), referrer host name (up to 255 characters), the paragraph fingerprint (HTTPS only), and whether it has been notified. Only the referrer’s host name is sent, never its path or query string.

What it never does

• Set cookies or store anything in the visitor’s browser. (For the rate limits it keeps a one-way hash of the IP address, for up to an hour.)
• Send anything to an outside service. Reports reach only your site; email goes out through WordPress’s own mail function.
• Read the clipboard. It reads only the text selected on the page.
• Store logs or counts in wp_options.

How rate limits are counted

The counters are WordPress transients. Without a persistent object cache, transients are rows in wp_options. To keep that small, per-IP keys expire after 60 seconds and the site-wide key after one hour, none are autoloaded, and the keys use a hash rather than the IP address itself. Site Health’s Info tab (“Rate-limit counters stored in”) shows where they are kept on your site.

14

Page caching

The plugin works with page caching, whether from a caching plugin or the server. The detection script uses no per-visitor token (nonce), so cached pages never carry an expired one.

• The settings embedded in the page are the post ID, minimum length and content selector, plus the reader message and source details when those are switched on. Nothing differs between visitors.
• After changing the Detection or Visitors tab, clear your page cache. The settings are embedded in the page, so old cached pages keep the old values.
• If you use an optimization feature that combines or delays JavaScript and nothing is being logged, exclude rapls-copy-notice.js from it and test again.
• Make sure REST API requests are not cached (most caches don’t cache POST requests).

15

Reverse proxies and CDNs

The visitor’s IP address normally comes from the direct connection (REMOTE_ADDR). Headers such as X-Forwarded-For are ignored, because anyone can forge them.

If the site sits behind a CDN such as Cloudflare or another reverse proxy, the direct connection is the proxy. Left as is:

• every row in the log shows the same (proxy) IP address;
• all visitors share the per-IP limit (10 per minute by default).

Setting it up

1. Find your proxy’s IP addresses or ranges. For Cloudflare, use its published IP ranges.
2. Enter them under Detection → Trusted proxies, one per line (CIDR such as 173.245.48.0/20 is fine).
3. From then on, and only for requests that come from those addresses, the plugin reads X-Forwarded-For from the right and takes the first address that is not itself a trusted proxy. If an entry is malformed, it falls back to the direct connection.

X-Forwarded-For is the only header used. If your site is not behind a proxy, leave the field empty. The “Visitor IP addresses” check in Site Health tells you when a proxy entry is probably needed.

16

Multisite

• The log table, settings and scheduled tasks are per site. Each site is set up under its own Tools → Rapls Copy Notice; there is no network settings page.
• Network activation works. Each site creates its own table the first time the plugin loads there.
• When a site is deleted from the network, its log table is deleted with it (1.3.0 and later).
• Deleting the plugin removes its data from every site in the network (see Deactivating and deleting).

17

For developers

Running your own code each time a copy is stored:

add_action( 'rapls_cn_logged', function ( $log_id, $row ) {
    // $row['copied_text'] and friends came from a visitor: escape on output.
    error_log( sprintf( 'copy #%d on post %d', $log_id, $row['post_id'] ) );
}, 10, 2 );

The rapls-cn:copy page event

The plugin sends nothing to analytics services itself. If you want to forward copies to your own analytics, the script fires a rapls-cn:copy event on document each time it reports a copy. detail holds the post ID and the length of the selection; the copied text is not included.

document.addEventListener( 'rapls-cn:copy', function ( e ) {
    // e.detail.postId, e.detail.length
} );

The event fires when the browser sends the report, so it also fires for reports the server then drops because of a limit or an exclusion.

18

Troubleshooting

Nothing is being logged

1. Test logged out. Administrators and editors are ignored by default. Use a private window.
2. Copy at least 20 characters from the body of a single post. The front page, archives, sidebar and comments are not monitored. Make sure the post is published.
3. Check the content area. If your theme wraps the post body in none of .entry-content, .post-content or article, every copy falls outside it. Turn on Detection → Find the post body, or enter a selector that matches your theme under Content area. Your browser’s developer tools show the class names around the post body.
4. Check the exclusions. Is your IP under Ignore IP addresses, or the post under Ignore posts? Is the post type ticked under Post types?
5. Don’t test too fast. The same text copied again within 10 seconds is not reported twice, and one IP address gets 10 reports per minute.
6. Clear the page cache after changing Detection settings.
7. Is the REST API blocked? A security plugin that blocks the REST API for logged-out visitors stops the reports. Allow /wp-json/rapls-copy-notice/v1/log.
8. Look at Site Health. A critical “log table” result means copies cannot be stored. Deactivate and reactivate the plugin.

Emails are late or don’t arrive

• Summaries don’t go out on the hour. WP-Cron runs when the site gets a visit, so on a quiet site the email goes out with the first visit after the hour. If you want to know straight away, switch to instant mode (One email per copy, right away).
• WP-Cron disabled: if wp-config.php sets DISABLE_WP_CRON, make sure a server cron job calls wp-cron.php regularly. Without it, neither summaries nor cleanup run. The “scheduled tasks” check in Site Health shows delays.
• Instant mode, but a summary arrived: copies over the hourly cap (Instant email limit, 20 by default) roll into the next hourly summary.
• Nothing arrives at all: check the “notification address” result in Site Health. If the address is fine, WordPress mail itself is the problem: look in the spam folder and in your SMTP plugin’s log. A custom Email subject makes the messages easy to find and filter.

Every IP address looks the same

The site is behind a reverse proxy or CDN and the proxy’s address is being logged. Add the proxy under Trusted proxies as described in Reverse proxies and CDNs. Rows stored before that keep the old address.

The IP addresses end in 0

That is expected. IP addresses are shortened before storage by default (Privacy tab).

19

Moving from an older plugin

If you used Check Copy Contents, which is no longer maintained, you can move to this plugin. It covers the same need, logging copied text and emailing you about it, and it is a separate plugin written from scratch.

1. Install and activate Rapls Copy Notice.
2. If the old plugin’s settings are still in the database, three of them are carried over on first activation:
   • the notification address (if it differs from the site administration email);
   • the minimum length;
   • a custom subject (the old plugin’s default subject is not carried over).
3. Carried-over values go through the same checks as a saved form. The old “notify for logged-in users” setting is not carried over; administrators and editors stay ignored.
4. While the old plugin is still active, this plugin’s screen shows a notice saying it is still active, no longer maintained, and that its settings were carried over where possible. Use Go to Plugins to deactivate it. If you don’t, you will get two emails per copy.

The old plugin’s records (past copies) are not moved.

20

Deactivating and deleting

Deactivating

The hourly summary and the daily cleanup are unscheduled. The log and settings stay, so reactivating picks up where you left off.

Deleting

Deactivate the plugin on the Plugins screen, then click Delete. This removes the following, with no undo:

• the log table {prefix}rapls_cn_log (every record);
• the settings rapls_cn_settings and the schema version rapls_cn_db_version;
• every option and transient whose name starts with rapls_cn_ (rate-limit counters included), except the add-on’s rapls_cn_pro_*, which the add-on removes itself;
• the scheduled events rapls_cn_send_digest and rapls_cn_purge_old_logs;
• each user’s rows-per-page screen option.

On multisite the same is removed from every site in the network. If you want to keep any records, note them down before deleting.

21

FAQ

Can it stop people from copying?

No, and it is not meant to. Blocking selection or right-click gets in the way of ordinary readers and does not stop anyone determined. The plugin only tells you what is being copied.

Do readers see anything?

Not by default. Only when you turn on the two features on the Visitors tab does a message appear or a source line get added to copied text.

Can I count copies in Google Analytics or another tool?

The plugin does not send anything there. Listen for the rapls-cn:copy event in your own script and forward it.

How do I tell these emails apart from others?

Enter your own words under Notifications → Email subject. The subject becomes “[site name] your words (N copies)”.

How do I see whether one paragraph is copied again and again?

Use Copies of this paragraph on the Log tab (HTTPS sites only).

22

About the add-on

A separate, paid add-on, Rapls Copy Notice Pro, builds on this plugin. It adds statistics by post and by paragraph, notifications to Slack, Chatwork, Discord or a webhook, routing rules, a web search for your most copied paragraphs, and CSV export of the log. The free plugin works the same with or without it.

While the add-on is not installed, the plugin’s screen shows a Pro features tab that only describes it, plus short notes on related screens. They disappear when the add-on is active. To hide them, return false from the rapls_cn_show_upsell filter:

add_filter( 'rapls_cn_show_upsell', '__return_false' );