Security
How WPDeeply handles security in its own plugin and infrastructure.
A security product that will not describe its own data handling is asking for trust it has not earned. Here is ours.
What Risk Monitor reads
The plugin reads what WordPress already knows: the list of installed plugins and themes with their versions and active state, the WordPress version, the PHP version, and a small number of configuration constants such as whether debugging is enabled.
What leaves your site
- Sent: component slugs, version numbers, active/inactive state, WordPress version, PHP version.
- Not sent: post content, page content, user accounts, email addresses, passwords, order data, database contents, file contents, IP addresses of your visitors.
A scan is a version comparison. It does not need your content, so it does not ask for it.
Data retention
- Free scans are stateless on our side. Results are stored in your own WordPress database so you can see them again.
- Paid monitoring stores scan histories so it can report what changed. Those histories are deleted 30 days after a licence ends.
- Waitlist and contact emails are kept until the enquiry is closed, then deleted.
Transport and API security
All requests use HTTPS. The matching API is read-only: it accepts a component list and returns records. There is no endpoint that can write to your site, and the plugin never executes code returned by the API.
Our own infrastructure
- Administrative access uses two-factor authentication.
- WordPress core, plugins and themes on this site are patched on a fixed schedule and monitored by our own product.
- Backups are encrypted and tested by restoring them, not by assuming.
Reporting a vulnerability in WPDeeply
Email legal@wpdeeply.com. We acknowledge within five working days, and we will not threaten a researcher acting in good faith. See responsible disclosure for what to include.
Last updated: 8 August 2026.