wpsecscan v2.9.1
☰
/ privacy

Privacy

This page covers the website wpsecscan.com and, separately, the scanner you download from it. Last changed 2026-10-12.

What this site collects

The site has no accounts, no newsletter and no cookie banner. Every page loads Google Analytics 4 (measurement ID G-XDB08JT3F6) with the standard tag and no custom settings. Google receives each page view together with the usual browser request details. Google's documentation says GA4 sets the first-party cookies _ga and _ga_XDB08JT3F6 and does not log or store IP addresses; we do not configure anything beyond that default.

Pages also load the Inter and JetBrains Mono fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), so Google sees your IP address for those requests. To opt out of analytics, block googletagmanager.com in your browser or content blocker, or install Google's Analytics opt-out browser add-on.

The site content is public and crawlable. robots.txt allows search engines and named AI crawlers, and disallows only /api/.

The feedback form

The form asks for a kind, a message, and optionally your e-mail address, your WordPress version and your WPSecScan version. A hidden field catches bots. A Cloudflare Worker sends the submission through the Resend e-mail service to the maintainer's mailbox. The e-mail also includes your IP address, the country Cloudflare derives from it, and your browser's User-Agent (first 200 characters).

We store nothing on the website itself. The copy in the maintainer's mailbox is the only record we keep, and it stays there until deleted. To limit abuse, the Worker may keep a short-lived counter per IP address in Cloudflare KV. It expires after at most 600 seconds (a sliding window). To have a message deleted, e-mail the address below.

Hosting and logs

The site is static pages served by nginx in a container on a Hetzner Cloud server in the EU, behind Cloudflare, which acts as the CDN and proxy and therefore sees every request. nginx.conf contains no access_log directive, so we have not turned logging off: assume the origin keeps ordinary access-log lines (address, time, path, User-Agent). We do not analyse them and do not set a retention period in this repository.

The scanner itself

The scanner is separate from this website. Besides the target, a default (passive) scan contacts these third parties. Each sees your IP address and receives only a hostname, component names or CVE ids, never site secrets:

See docs/data-sources.md. Patchstack and Sentry need your tokens.

The update check also runs by default: the scanner asks the GitHub releases API for the latest version (cached 24 hours) and prints a notice if a newer one exists. Skip with --no-update-check.

There is no telemetry sent to us. Usage analytics exist but are off by default. After wpsecscan analytics enable they are written only to a local file (~/.wpsecscan/analytics/events.jsonl): subcommand names, check IDs, durations, bucketed finding counts and a random ID that rotates quarterly. No target URLs or findings are recorded. We do not run a collection endpoint, and the current source does not upload that file automatically. Crash reports are posted only if you set WPSECSCAN_GLITCHTIP_DSN.

Your rights and contact

You can ask us for a copy of what we hold about you, for it to be corrected or deleted, to restrict or stop us using it, or to receive it in a portable form. If you are in the EU or UK you can also complain to your data protection authority. Because we keep no accounts, the only data we can find is in feedback e-mails, so include the address or approximate time you wrote in. Contact the maintainer at [email protected]. Google, Cloudflare and Resend process data under their own policies; we cannot delete data they hold for their own purposes.

Changes

Last updated 2026-10-12. If this page changes, the date here changes with it.