Screen: ApprovalTrail → Settings (admin.php?page=approvaltrail-settings) Capability required: manage_woocommerce
All settings are stored in a single option (approvaltrail_settings) and run through one sanitization routine. Any key it doesn’t recognize is dropped rather than stored, so a stray filter or a bad import can’t silently add junk to your configuration.
Hold production
Checkbox: “Hold production.” Default: on.
Stops an order from entering a status you’ve marked as guarded while a proof on it is waiting on the customer. See Holding production until approval for the full behavior.
What people get wrong: they expect this to also block cancellations or refunds. It never does. cancelled, refunded, failed, pending and checkout-draft orders can’t be guarded, no matter what’s ticked here.
Guarded statuses
Checkbox list of order statuses. Default: Processing, Completed.
Which statuses the production lock actually guards. Add or remove statuses freely, with the exception noted above, which can never be added regardless of what you tick.
Hold status
Dropdown. Default: On hold.
Where a blocked order is parked when the lock refuses a status change.
Link expiry
Number, 1–3650 days. Default: 30.
How long an approval link stays valid before it expires on its own. Issuing a fresh link (via revoke & reissue) always kills the old one immediately, regardless of this setting.
Notify staff at
Textarea, one email address per line. Default: empty.
Who gets told when a customer makes a decision. Empty doesn’t mean “nobody.” It means the site administrator’s address is used. If you want no staff notification at all, that’s a job for the approvaltrail_email_recipients filter; see Hooks.
Maximum upload size
Number, entered in MB. Default: 0 (unlimited by ApprovalTrail).
A ceiling on proof file size. 0 means “whatever the server allows.” Whatever number you enter here, your server’s own upload ceiling always wins: this setting can only make the limit smaller, never larger, than what your host permits. Check the storage meter on this same screen to see the server’s actual ceiling.
Retention window
Number, 0–3650 days. Default: 90.
How long after a decision the master file stays on disk before it’s released to reclaim space. 0 means keep forever. Whatever you choose, the preview image, the file’s fingerprint, the version metadata and the full decision record are always kept — releasing the master never touches the evidence. Full explanation in Files, previews and retention.
Allow SVG uploads
Checkbox. Default: off.
SVG is off by default on purpose. An SVG file is a script-capable document, and accepting one widens what a malicious upload could do. Turn it on only if you understand that trade-off and trust who’s uploading.
Keep records on uninstall
Checkbox. Default: on.
If you delete the plugin, your proof and decision records stay in the database when this is on.
Also delete files on uninstall
Checkbox. Default: off.
Only takes effect if “Keep records on uninstall” is switched off. Deletes uploaded proof files along with the plugin. This is irreversible — there’s no undo once the plugin’s uninstall routine has run.
What else the plugin stores
These aren’t user-facing settings — you won’t find them on this screen — but they’re worth knowing about if you’re inspecting your site’s options table:
| Option | Purpose |
|---|---|
approvaltrail_schema_version |
Internal migration marker |
approvaltrail_ip_salt |
A per-site random value used to hash visitor IP addresses. Never leaves your site. |
approvaltrail_setup_complete |
Whether the setup walkthrough has been finished or dismissed |
approvaltrail_sample_order |
The ID of the walkthrough’s sample order, kept so it can be cleanly removed |
approvaltrail_license |
Licensed build only — license state |
Overriding settings in code
If you need a different value on a staging site, or want to compute a setting dynamically, five filters override these values at runtime without touching the settings screen: approvaltrail_approval_link_expiry, approvaltrail_retention_days, approvaltrail_max_upload_bytes, approvaltrail_allowed_mime_types, and approvaltrail_production_lock_statuses. See Hooks for signatures and examples.