# WordPress security plugin privacy: what leaves your site

What a WordPress security plugin sends off your site: what BetterShield contacts out of the box, what each optional service gets, and how to check.

By M Asif Rahman, Oct 23, 2026. Updated Nov 3, 2026.

A WordPress security plugin should be able to tell you, in one list, which outside services it contacts and what it sends them. For **BetterShield** the answer is short: file checks ask WordPress.org about core and directory plugins, and use publisher checksums for supported WPDeveloper paid plugins. Usage sharing, the leaked-password check, your AI provider and BetterShield Hub are each off until you turn them on, and there is no account to create.

This guide shows how to read that list, what each optional service receives, and how to confirm it on your own site. If you are weighing the sign-in side of the same question, [what leaves your site during the breached password check](/blog/wordpress-breached-password-check/) goes through that one service step by step, and [connecting an AI assistant safely](/blog/ai-assistant-wordpress-security/) covers the assistant side.

## Quick summary

- BetterShield checks core and directory plugins through WordPress.org, and supported WPDeveloper paid plugins through publisher checksums. None of those requests carries your site address, email, usernames, keys or file contents.
- Share usage data, the breached-password check, your own AI provider and BetterShield Hub are off until you switch them on.
- Each optional service has a stated trigger, a stated payload and a stated way to turn it off, all listed in one reference page.
- Your visitors’ page loads never trigger an outside request from BetterShield.
- WordPress’s own **Policy Guide**, **Export Personal Data** and **Erase Personal Data** tools already know about BetterShield, so there is nothing extra to install for privacy requests.

## Why it matters

A security plugin sits close to everything on a site: accounts, sign-ins, files and settings. It is reasonable to ask what, if anything, it passes on. The honest answer is a table, not a promise. A table lets you read each row, decide whether you want that service, and show the same table to a client, a colleague or whoever signs off on your privacy policy.

It also helps with the policy itself. The services a site contacts are part of what a [privacy policy](https://en.wikipedia.org/wiki/Privacy_policy) is expected to describe, and WordPress documents how plugins should contribute to it in its [plugin privacy handbook](https://developer.wordpress.org/plugins/privacy/). BetterShield follows that route, as the later section on the Policy Guide shows.

## What BetterShield contacts out of the box

File checks use WordPress.org for core and directory plugins, plus the publisher for supported WPDeveloper paid plugins. Each request identifies the version being compared.

| Service | When | What is sent |
|---|---|---|
| **api.wordpress.org** | During the hourly file check; each list is kept for a week | Your WordPress version and language |
| **api.wordpress.org** | Daily, asking whether the directory still lists up to eight of your directory plugins | One plugin’s slug per request |
| **downloads.wordpress.org** | During the file check, on **Check again**, and whenever a plugin is installed or updated | The plugin’s slug and version |
| **checksums.wpdeveloper.com**, with **bettershield.ai** as an Ultra fallback | During file checks or updates of supported WPDeveloper paid plugins | The plugin’s slug and version |
| **core.svn.wordpress.org**, **plugins.svn.wordpress.org** | Only when you press **Show the difference** or **Put the official file back** on a changed file | The version and the file’s path |

None of these requests carries your site address, email, usernames, keys, file contents or any identifier. They name only BetterShield and its version. Like any connection they come from your server’s IP address, they never run while a visitor loads a page, and if WordPress.org cannot be reached the check says it could not run rather than reporting a clean result.

## What stays off until you turn it on

Four things are optional. Each one has a switch or a button, and each one only happens after you use it.

| Service | Only if you… | What is sent | Turn it off |
|---|---|---|---|
| **Share usage data** (WPDeveloper’s usage service) | Choose **Allow & Continue** in Quick Setup, or switch on **Share usage data** | Site address and title, administrator email, software versions, language, installed plugins and your theme. Never visitors, users, sign-ins or findings. | Switch off **Share usage data** under **Settings › General** |
| Breached-password check (Have I Been Pwned) | Turn on **Leaked password check** | The first five characters of a password’s hash. The comparison happens on your server. | Turn that fix off |
| **Your own AI provider** | Press **Explain this in plain language** on a finding, **Explain my audit** on the Overview, or **Explain this** on an incident, with a provider connected | A description of the finding or incident with addresses removed; never file contents, usernames, keys or your site address | Do not press the buttons, or remove the provider |
| **BetterShield Hub** | Press **Connect to BetterShield Hub** | Your site’s address, version and security views to the hub you approve | Turn off **Hub link**, or **Disconnect** |

Two points are worth stating plainly. First, BetterShield never asks for or stores your AI provider’s key: the buttons only work when you have connected a provider under **Settings › Connectors**, and they send nothing until you press one ([how the three explain buttons work](/blog/explain-wordpress-security-audit-with-ai/)). Second, assistants you connect under **Agents › Connect** call your site; your site never calls them. The reference page lists every field for each row, and it is the page to open when someone asks for the exact payload.

### Set it up

You do not need to configure anything to get the default behavior. To review or change the optional services:

1. Open **BetterShield › Settings › General** and find **What leaves this site**.
2. Read **What we collect** next to **Share usage data** before deciding. Leave **Share usage data** off if the site and administrator details it lists must not be shared.
3. Open **Protection › Login & Access** and look at **Leaked password check**. It contacts Have I Been Pwned only when someone signed in sets or changes a password.
4. Open **Settings › Connectors** and check whether an AI provider is connected. Remove it if you do not use the explain buttons.
5. Open **BetterShield › Hub** and check whether the site is connected. **Disconnect** ends the link.

## What BetterShield Ultra adds

With the paid add-on installed, there are a few more rows, each tied to a feature you use. The licence service is contacted when you activate or stop using a licence, weekly while one is active, and when WordPress checks for plugin updates. The Cloudflare tab contacts Cloudflare only after you save a token. The bot check loads Cloudflare Turnstile in the visitor’s browser on the forms it guards. Alert channels send to the Slack, webhook or syslog addresses you add, and the client report’s paragraph drafting uses your AI provider only when you press **Draft a paragraph**. Everything here follows the same pattern as the free plugin: a trigger you control, a payload that is listed, and an off switch.

## What it can break, and how to undo

Nothing about this changes how your site behaves, so there is little to break. The trade-offs are small and reversible:

- **Turning off the breached-password check** removes a protection, not a privacy risk. You can turn it back on at any time.
- **Leaving usage sharing off** costs nothing. Turning it off later stops future reports but cannot recall one already sent.
- **Disconnecting the Hub** ends the link and the site stops sending events. Reconnecting is a deliberate step.
- **Removing your AI provider** only disables the explain buttons.

Every change is a switch you can flip back.

## Check it is working

Do not take the list on trust; check it against your own site.

- **Read the reference.** Open [What BetterShield contacts](/docs/what-bettershield-contacts/) and compare it row by row with the switches on your own screens.
- **Look at the Policy Guide.** Under **Settings › Privacy › Policy Guide**, the **BetterShield** section lists the services your site contacts right now. It follows what is switched on when you open it, so open it again after you change a switch.
- **Check Site Health.** **Tools › Site Health › Info** has a section named **BetterShield: what it keeps about people**, with one line for each kind of record, how long it is kept and whether an erasure removes it.
- **Watch the outside traffic.** If you want proof, log outbound requests from your server for a day. Expect the WordPress.org hosts in the first table, plus publisher checksum requests when supported WPDeveloper paid plugins are installed.

## Personal data on your own site

What leaves the site is half the question; what stays on it is the other half. BetterShield never stores a whole IP address. It keeps the network instead: the first three groups of an IPv4 address, or the first four of an IPv6 address. Sign-in attempts are kept for two days, and activity log rows for 30 days (90 with Ultra). WordPress’s **Export Personal Data** and **Erase Personal Data** tools include BetterShield’s records, and the erasure removes what belongs to the person while keeping the site’s security record, with the person taken out of it where that is possible. The full table is in [Privacy and personal data](/docs/privacy-and-personal-data/).

## Recommended settings

We recommend treating the defaults as the starting point and changing them only for a reason you can state.

| Situation | What we recommend |
|---|---|
| A site with a strict privacy policy | Leave **Share usage data** off, and copy BetterShield’s **Policy Guide** text into your policy |
| A site where members choose their own passwords | Consider **Leaked password check**, knowing it sends five hash characters per check |
| A site that never uses the explain buttons | Keep no AI provider connected |
| An agency managing many sites | Connect to BetterShield Hub only for sites whose owners agree to it |

Copy the Policy Guide text again whenever you turn one of these on or off, because your published policy does not change by itself.

## Frequently asked questions

### Does a WordPress security plugin send data to its developer?

It depends on the plugin, and the way to find out is to read its list of outside services. Supported WPDeveloper paid-plugin file checks send the plugin slug and version to the publisher for checksums. WPDeveloper’s usage service is contacted only after you choose **Allow & Continue** in Quick Setup or switch on **Share usage data**.

### What does BetterShield send to WordPress.org?

Your WordPress version and language for the file check, and a plugin’s slug and version when it compares plugins. It does not send your site address, email, usernames, keys or file contents.

### Does BetterShield send passwords anywhere?

No. With the breached-password check on, only the first five characters of a password’s hash leave the site, and the comparison happens on your server. Never the password, the account, the email or the site address.

### Can I use BetterShield without any account?

Yes. There is no account to create. The free plugin works on its own, and BetterShield Hub is an optional connection you start yourself.

### Does it run when visitors load my pages?

The outside requests listed here never run while a visitor loads a page. The exception to note is the bot check in Ultra, where the visitor’s browser loads Cloudflare Turnstile’s script on the forms it guards.

## Conclusion

Knowing what a security plugin contacts is part of trusting it. BetterShield uses WordPress.org and supported publisher checksums for file verification, asks before optional services are enabled, and lists what each one receives. Review the switches once, keep the ones you need, and copy the Policy Guide text into your privacy policy. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/), and the complete reference is [What BetterShield contacts](/docs/what-bettershield-contacts/).