Self-hosted, as a privacy focused WordPress security plugin should be
The firewall, the login protection, the malware scans, the activity log and the live traffic view all run inside your WordPress install, and what they record is stored in your site's database. The exceptions are listed further down this page.
The plugin's own console loads no fonts or scripts from a CDN, so opening its screens doesn't tell a third party that you did.
Device fingerprinting, only if you ask for it
Fingerprinting lets the sign-in lockout recognise one device even as it rotates through different IP addresses. It's useful against patient password guessers, and it is also personal data, so it's off until you choose it.
When it's on, the result is kept only as a salted hash on your site, used only for security decisions, and never sent anywhere. If you switch it on, mention it in your privacy policy.
Off by default. Offered in Recommended settings.
A leaked-password check that never sends the password
The optional leaked-password check asks the Pwned Passwords service whether a password has appeared in a known breach. It uses k-anonymity: only the first 5 characters of the password's SHA-1 hash leave your site, and the responses are padded so their size gives nothing away. If the service can't be reached, the password is allowed. More on this in login security.
Off by default. Included in Recommended settings.
Redaction where it counts
The status report you copy from the plugin leaves out your database name and host. The activity log replaces fields that look like passwords, tokens or keys with "[redacted]", and so does full-traffic capture for query values in a URL. A security log shouldn't become a store of credentials.
What does leave your site
Only what each feature needs. The full list, with who receives what, is in the Privacy Policy.
- WordPress.org: file checksums and plugin details are fetched from it, and a daily check of your plugins sends only their public slugs.
- wpsecuregate.com: licence checks, signed updates, the attacker IP list, the country database and a daily check-in with your site address, versions and licence state.
- Network learning: once a day a licensed site reports the IP addresses its firewall blocked for an attack, each with the attack type, the rule and a count, and nothing else about the request. It's on by default, with an opt-out at Firewall, Settings, Threat intelligence.
- Malware verdicts: files and post content the scanner has already flagged are sent for a verdict, which an AI model may help decide. wp-config.php and .htaccess are never sent, and the server keeps the file's hash and verdict, not the file. It's on by default and you can switch it off.
- Alert emails: an IP address named in an alert is looked up for its location and not stored.
- The leaked-password check, if you switch it on: five characters of a password's hash.
- A CAPTCHA provider, only if you choose one.
GDPR friendly, not a compliance badge
WP SecureGate is designed to collect little and to disclose what it sends, which makes it easier to describe honestly in your own privacy notice. It doesn't make a site compliant on its own. Whether your site meets GDPR or any other law depends on your whole setup: your other plugins, your hosting, your policies and what you tell your visitors.
Part of WP SecureGate: the all-in-one WordPress security plugin →