WordPress security plugin privacy: what leaves your site
A WordPress security plugin should be able to tell you, in one list, which outside services it contacts and what it sends them. For BetterShield the answer is short: file checks ask WordPress.org about core and directory plugins, and use publisher checksums for supported WPDeveloper paid plugins. Usage sharing, the leaked-password check, your AI provider and BetterShield Hub are each off until you turn them on, and there is no account to create.
This guide shows how to read that list, what each optional service receives, and how to confirm it on your own site. If you are weighing the sign-in side of the same question, what leaves your site during the breached password check goes through that one service step by step, and connecting an AI assistant safely covers the assistant side.
Quick summary
- BetterShield checks core and directory plugins through WordPress.org, and supported WPDeveloper paid plugins through publisher checksums. None of those requests carries your site address, email, usernames, keys or file contents.
- Share usage data, the breached-password check, your own AI provider and BetterShield Hub are off until you switch them on.
- Each optional service has a stated trigger, a stated payload and a stated way to turn it off, all listed in one reference page.
- Your visitors’ page loads never trigger an outside request from BetterShield.
- WordPress’s own Policy Guide, Export Personal Data and Erase Personal Data tools already know about BetterShield, so there is nothing extra to install for privacy requests.
Why it matters
A security plugin sits close to everything on a site: accounts, sign-ins, files and settings. It is reasonable to ask what, if anything, it passes on. The honest answer is a table, not a promise. A table lets you read each row, decide whether you want that service, and show the same table to a client, a colleague or whoever signs off on your privacy policy.
It also helps with the policy itself. The services a site contacts are part of what a privacy policy is expected to describe, and WordPress documents how plugins should contribute to it in its plugin privacy handbook. BetterShield follows that route, as the later section on the Policy Guide shows.
What BetterShield contacts out of the box
File checks use WordPress.org for core and directory plugins, plus the publisher for supported WPDeveloper paid plugins. Each request identifies the version being compared.
| Service | When | What is sent |
|---|---|---|
| api.wordpress.org | During the hourly file check; each list is kept for a week | Your WordPress version and language |
| api.wordpress.org | Daily, asking whether the directory still lists up to eight of your directory plugins | One plugin’s slug per request |
| downloads.wordpress.org | During the file check, on Check again, and whenever a plugin is installed or updated | The plugin’s slug and version |
| checksums.wpdeveloper.com, with bettershield.ai as an Ultra fallback | During file checks or updates of supported WPDeveloper paid plugins | The plugin’s slug and version |
| core.svn.wordpress.org, plugins.svn.wordpress.org | Only when you press Show the difference or Put the official file back on a changed file | The version and the file’s path |
None of these requests carries your site address, email, usernames, keys, file contents or any identifier. They name only BetterShield and its version. Like any connection they come from your server’s IP address, they never run while a visitor loads a page, and if WordPress.org cannot be reached the check says it could not run rather than reporting a clean result.
What stays off until you turn it on
Four things are optional. Each one has a switch or a button, and each one only happens after you use it.
| Service | Only if you… | What is sent | Turn it off |
|---|---|---|---|
| Share usage data (WPDeveloper’s usage service) | Choose Allow & Continue in Quick Setup, or switch on Share usage data | Site address and title, administrator email, software versions, language, installed plugins and your theme. Never visitors, users, sign-ins or findings. | Switch off Share usage data under Settings › General |
| Breached-password check (Have I Been Pwned) | Turn on Leaked password check | The first five characters of a password’s hash. The comparison happens on your server. | Turn that fix off |
| Your own AI provider | Press Explain this in plain language on a finding, Explain my audit on the Overview, or Explain this on an incident, with a provider connected | A description of the finding or incident with addresses removed; never file contents, usernames, keys or your site address | Do not press the buttons, or remove the provider |
| BetterShield Hub | Press Connect to BetterShield Hub | Your site’s address, version and security views to the hub you approve | Turn off Hub link, or Disconnect |
Two points are worth stating plainly. First, BetterShield never asks for or stores your AI provider’s key: the buttons only work when you have connected a provider under Settings › Connectors, and they send nothing until you press one (how the three explain buttons work). Second, assistants you connect under Agents › Connect call your site; your site never calls them. The reference page lists every field for each row, and it is the page to open when someone asks for the exact payload.
Set it up
You do not need to configure anything to get the default behavior. To review or change the optional services:
- Open BetterShield › Settings › General and find What leaves this site.
- Read What we collect next to Share usage data before deciding. Leave Share usage data off if the site and administrator details it lists must not be shared.
- Open Protection › Login & Access and look at Leaked password check. It contacts Have I Been Pwned only when someone signed in sets or changes a password.
- Open Settings › Connectors and check whether an AI provider is connected. Remove it if you do not use the explain buttons.
- Open BetterShield › Hub and check whether the site is connected. Disconnect ends the link.
What BetterShield Ultra adds
With the paid add-on installed, there are a few more rows, each tied to a feature you use. The licence service is contacted when you activate or stop using a licence, weekly while one is active, and when WordPress checks for plugin updates. The Cloudflare tab contacts Cloudflare only after you save a token. The bot check loads Cloudflare Turnstile in the visitor’s browser on the forms it guards. Alert channels send to the Slack, webhook or syslog addresses you add, and the client report’s paragraph drafting uses your AI provider only when you press Draft a paragraph. Everything here follows the same pattern as the free plugin: a trigger you control, a payload that is listed, and an off switch.
What it can break, and how to undo
Nothing about this changes how your site behaves, so there is little to break. The trade-offs are small and reversible:
- Turning off the breached-password check removes a protection, not a privacy risk. You can turn it back on at any time.
- Leaving usage sharing off costs nothing. Turning it off later stops future reports but cannot recall one already sent.
- Disconnecting the Hub ends the link and the site stops sending events. Reconnecting is a deliberate step.
- Removing your AI provider only disables the explain buttons.
Every change is a switch you can flip back.
Check it is working
Do not take the list on trust; check it against your own site.
- Read the reference. Open What BetterShield contacts and compare it row by row with the switches on your own screens.
- Look at the Policy Guide. Under Settings › Privacy › Policy Guide, the BetterShield section lists the services your site contacts right now. It follows what is switched on when you open it, so open it again after you change a switch.
- Check Site Health. Tools › Site Health › Info has a section named BetterShield: what it keeps about people, with one line for each kind of record, how long it is kept and whether an erasure removes it.
- Watch the outside traffic. If you want proof, log outbound requests from your server for a day. Expect the WordPress.org hosts in the first table, plus publisher checksum requests when supported WPDeveloper paid plugins are installed.
Personal data on your own site
What leaves the site is half the question; what stays on it is the other half. BetterShield never stores a whole IP address. It keeps the network instead: the first three groups of an IPv4 address, or the first four of an IPv6 address. Sign-in attempts are kept for two days, and activity log rows for 30 days (90 with Ultra). WordPress’s Export Personal Data and Erase Personal Data tools include BetterShield’s records, and the erasure removes what belongs to the person while keeping the site’s security record, with the person taken out of it where that is possible. The full table is in Privacy and personal data.
Recommended settings
We recommend treating the defaults as the starting point and changing them only for a reason you can state.
| Situation | What we recommend |
|---|---|
| A site with a strict privacy policy | Leave Share usage data off, and copy BetterShield’s Policy Guide text into your policy |
| A site where members choose their own passwords | Consider Leaked password check, knowing it sends five hash characters per check |
| A site that never uses the explain buttons | Keep no AI provider connected |
| An agency managing many sites | Connect to BetterShield Hub only for sites whose owners agree to it |
Copy the Policy Guide text again whenever you turn one of these on or off, because your published policy does not change by itself.
Frequently asked questions
Does a WordPress security plugin send data to its developer?
It depends on the plugin, and the way to find out is to read its list of outside services. Supported WPDeveloper paid-plugin file checks send the plugin slug and version to the publisher for checksums. WPDeveloper’s usage service is contacted only after you choose Allow & Continue in Quick Setup or switch on Share usage data.
What does BetterShield send to WordPress.org?
Your WordPress version and language for the file check, and a plugin’s slug and version when it compares plugins. It does not send your site address, email, usernames, keys or file contents.
Does BetterShield send passwords anywhere?
No. With the breached-password check on, only the first five characters of a password’s hash leave the site, and the comparison happens on your server. Never the password, the account, the email or the site address.
Can I use BetterShield without any account?
Yes. There is no account to create. The free plugin works on its own, and BetterShield Hub is an optional connection you start yourself.
Does it run when visitors load my pages?
The outside requests listed here never run while a visitor loads a page. The exception to note is the bot check in Ultra, where the visitor’s browser loads Cloudflare Turnstile’s script on the forms it guards.
Conclusion
Knowing what a security plugin contacts is part of trusting it. BetterShield uses WordPress.org and supported publisher checksums for file verification, asks before optional services are enabled, and lists what each one receives. Review the switches once, keep the ones you need, and copy the Policy Guide text into your privacy policy. BetterShield is free on WordPress.org, and the complete reference is What BetterShield contacts.