Full disclosure
Privacy & data
A security plugin sees everything: every request, every login, every file. So the only acceptable answer to “what does it send back to you?” is a complete one. This page is that list — every external call the plugin can make, what data it carries, and how to switch it off.
Default behaviour
The free plugin does not send your site's data anywhere by default. No
analytics, no usage tracking, no phone-home on activation. The only outbound calls a
default install makes are to api.wordpress.org — the same public
service WordPress core already queries for update checks.
Every feature that talks to anything else is listed below, is off until you turn it on, and states what it sends. Nothing in the free tier requires our servers to work: install it with our infrastructure entirely unreachable and the firewall, scanner, integrity monitoring, hardening, 2FA, backups and audit log all function normally.
External services, in full
Breached-password check Free Optional
When a user logs in, the plugin can check whether their password appears in the Have I Been Pwned Pwned Passwords corpus. It uses k-anonymity: the password is hashed with SHA-1 locally and only the first five characters of that hash are sent. The service returns every hash suffix sharing that prefix and the match is determined on your server. The password, the full hash, the username and the site URL never leave your site.
It only ever warns the user — it never blocks a login. Disable it under Settings → Auth.
Login CAPTCHA Free Optional
If you enable Cloudflare Turnstile or Google reCAPTCHA on the login form, that provider's script loads on the login page and the provider receives what its own privacy policy describes — typically IP address and browser signals. See Cloudflare's policy or Google's policy. Off by default; when off, neither script is loaded anywhere on your site.
WordPress.org checksum & vulnerability APIs Free
Integrity verification for core, plugins and themes, and CVE lookups for installed
software, query the public api.wordpress.org service. These requests carry the
slugs and versions of your installed software — the same information core already
sends for update checks. No user data, file contents or request data is included.
Threat intelligence feed & Cloud Reputation Pro / opt-in
These call our own license and threat-intelligence service to pull signature updates and retrieve threat verdicts. License activation sends your license key and site URL, as any licensed product must to bind a seat. Reputation lookups send hashes and indicators — not file contents. Signature bundles are cryptographically verified before being applied.
Firewall-bypass telemetry Opt-in, off by default
If a request gets past the firewall that should have been blocked, that pattern is useful for improving the rules for everyone. This feature is disabled by default and requires explicit consent before any data is sent. When enabled, payloads pass through a redactor first to strip identifying content. Withdraw consent at any time and transmission stops immediately.
Sentinel AI Pro / opt-in
When enabled with consent, a redacted evidence bundle built from recent firewall and audit events for one suspicious actor is sent to our AI analysis service for a threat verdict. The bundle never contains full request bodies, and never personal data beyond what is already in your own audit log. It is disabled by default, requires the same explicit data-sharing consent as bypass telemetry, and without it the plugin falls back to local, conservative rule-based verdicts.
| Feature | Default | What leaves your server |
|---|---|---|
| Checksum & CVE lookups | On | Installed slugs and versions (public data) |
| Breached-password check | On | First 5 chars of a SHA-1 hash |
| Login CAPTCHA | Off | Whatever the chosen provider collects |
| Threat intel feed | Off (Pro) | License key, site URL |
| Cloud reputation | Off (Pro) | Hashes and indicators, not file contents |
| Bypass telemetry | Off (consent) | Redacted request patterns |
| Sentinel AI | Off (consent) | Redacted evidence bundle for one actor |
What is stored locally
The plugin stores a fair amount — all of it in your database and filesystem, on your own server:
- Audit log — security events with the acting user, source IP, proxy chain and request context. 90-day retention by default; configurable.
- Live Traffic buffer — a short rolling window of recent requests, including IP and user agent.
- Firewall logs — blocked requests and the rule that matched.
- Scan results and integrity baselines — file paths and hashes.
- Quarantine store — files moved out of the site, retained so a false positive can be reversed.
- Backups — full copies of your files and database, wherever you configured them to be written.
- 2FA secrets, backup codes and trusted-device records for enrolled users.
Under GDPR, the IP addresses in the audit log and traffic feed count as personal data. That is not a reason to avoid logging them — you cannot investigate an incident without them — but it does mean they belong in your own privacy policy, with a stated retention period. Set retention to whatever your policy actually promises.
GDPR & personal data
For data the plugin stores on your server, you are the controller — it is your database. Where an opt-in feature sends data to our services, we act as a processor for that specific, disclosed purpose, and only after you have consented.
- Lawful basis — security logging is normally justified as legitimate interest: you cannot secure a site you cannot audit. The opt-in features above rely on consent instead, which is why they are off until you enable them.
- Data minimisation — telemetry and AI evidence bundles pass through a redactor before transmission, and neither carries full request bodies.
- Retention — audit retention is configurable, with automatic pruning past the window you set.
- Consent withdrawal — every consent-gated feature can be switched off from the dashboard, and transmission stops at once.
- Subject access & erasure — audit records export to CSV to satisfy an access request, and log entries can be pruned for erasure.
If your site serves EU visitors, mention in your privacy policy that you keep security logs including IP addresses, state the retention period, and disclose any of the opt-in services above that you have enabled.
Deletion & uninstall
Deleting the plugin treats two categories of change differently, on purpose:
- Server-level changes are always reverted — the firewall prepend, generated
.htaccessand Nginx rules, andwp-configmarkers. Always, regardless of settings, because orphaned rules could break a site that no longer has the plugin to manage them. - Security data is kept by default — logs, scan history and settings survive so a reinstall resumes where you left off.
For a complete wipe, enable Delete all data on uninstall in Settings before removing the plugin. Once it is deleted, the uninstall routine can no longer run. Note that backup archives already written to disk are yours — delete them yourself if you want them gone.
This website
totalsecuritywp.com is a static marketing site. It sets no tracking cookies
and runs no analytics or advertising scripts.
Third-party resources the pages do load, for completeness:
- Google Fonts — typefaces are fetched from
fonts.googleapis.comandfonts.gstatic.com, which means Google receives your IP address and user agent as part of that request. - CDN-hosted libraries — the animation and styling libraries on the home page load from
cdnjs.cloudflare.comandcdn.tailwindcss.com, with the same consequence.
Standard web server access logs are kept for operational and security purposes and are not used to profile visitors.
Contact
Privacy questions: [email protected]. Security vulnerabilities go through the disclosure policy instead, not this address.
This disclosure describes plugin version 1.2.0. Material changes are noted in the plugin's changelog on WordPress.org, published with each release.