Privacy & data

Default behaviour

Every other feature that talks to an outside service is off until you turn it on. All of them are listed below with what they send. Nothing requires our servers to protect your site: with our infrastructure unreachable, the firewall, scanner, integrity monitoring, hardening, 2FA, backups and audit log all keep working on the rules they already have. Requests the plugin makes identify themselves as LoyalSecurity/<version> rather than WordPress's default user agent, which includes your site's URL.

External services, in full

Threat-intelligence feed Free On by default

Keeps the firewall rules, malware signatures, virtual patches and the vulnerability (CVE) database current. Twice a day (hourly with a Pro subscription), and whenever you click Sync now, the plugin asks our service for each dataset and sends: the dataset name, the version it already has, the subscription key if Pro stored one, and — for the vulnerability dataset only — the slugs (folder names) of your installed plugins and themes, so only the advisories that concern them come back. It does not send your site URL, versions of your software, users or content. Bundles are cryptographically signed and verified before they are applied.

Turn automatic updates off under Settings → Threat Intelligence → Auto Sync (or disable the module there); the plugin then keeps using the rules it has.

Breached-password check Free On by default

When a user logs in, the plugin checks whether their password appears in the Have I Been Pwned Pwned Passwords corpus. It uses k-anonymity: the password is hashed with SHA-1 locally and only the first five characters of that hash are sent. The service returns every hash suffix sharing that prefix and the match is determined on your server. The password, the full hash, the username and the site URL never leave your site.

It only ever warns the user — it never blocks a login. Switch it off under Settings → Identity & Access → Breach Check.

WordPress.org checksums & packages Free

File-integrity verification downloads the official checksums of WordPress core and of your installed WordPress.org plugins (plugin slug and version) from WordPress.org. When you choose to repair or reinstall something, the official core or plugin package — or a single core file — is downloaded from the same place. These are the public services WordPress core already uses for updates; no user data, file contents or request data is sent.

“About Pro” pricing Free

Opening the About Pro screen in the dashboard fetches the public plan list from our service. No site data is sent.

CAPTCHA (login / registration / lost password) Free Off by default

If you enable Cloudflare Turnstile or Google reCAPTCHA, that provider's script loads on wp-login.php (never elsewhere on the site), and on submission the visitor's CAPTCHA token and IP address are sent to the provider to verify it. The provider also receives what its own privacy policy describes — typically browser signals. Once a provider is configured it protects the login, registration, and lost-password forms by default; each of the three can be individually opted back out from the dashboard. See Cloudflare's Turnstile policy or Google's policy. When no provider is configured, neither script is loaded anywhere on your site.

Google Safe Browsing Free Off by default

Only if you enter your own Safe Browsing API key: the plugin sends your site's home URL to Google to check whether it has been flagged. Nothing is sent without a key.

Firewall-bypass telemetry Opt-in, off by default

If a request gets past the firewall that should have been blocked, that pattern is useful for improving the rules for everyone. This feature is disabled by default and requires explicit consent before any data is sent. When enabled, the plugin sends the attacker's request (method, path, parameters, IP address and country), the matching rule names, coarse plugin/WordPress/PHP versions and an anonymous install ID. Cookies, authorization headers and nonces are stripped first. With the same consent, a virtual patch you approve can be shared as a rule suggestion. Withdraw consent at any time and transmission stops immediately.

Connection test Free Only when you click it

The Test connection button on the Threat Intelligence screen sends a timestamp, the anonymous install ID and, if present, a hash of the subscription key, so the service can report what is misconfigured.

Loyal Security Pro (separate plugin) Pro

The Pro plugin adds services of its own. None of these exist in the free plugin.

• Licence, updates and revocation — the licence key and the site’s address when a key is activated, renewed (about every 30 days) or removed; an hourly revocation check; and update checks, with the key in the request body, never in a URL.
• Hourly threat-intelligence feed — the licence key, dataset versions and, for CVE data, installed plugin and theme slugs. No site address.
• Cloud reputation Consent — SHA-256 hashes of flagged files and the ids of firewall rules that fired. Never file contents, paths or visitor data.
• Sentinel AI Consent — a redacted evidence bundle for one suspicious actor (firewall matches, login attempts, audit events). Never full request bodies, and no personal data beyond what is already in your own audit log.
• Uptime monitoring — the site’s address and the administrator’s email address, so our service can check the home page from outside every 5 minutes and email that address. Once a day it also reads the HTTPS certificate, looks up the domain’s expiry in the public RDAP registry and loads the home page to look for defacement, injected spam or scripts; where set up, our service asks Google Web Risk whether the home page address is listed as unsafe (Google receives only that address, from our service, not from your site).
• Audit log protection When turned on — every few minutes, the site’s address, a random chain id, event ids and counts, a timestamp and two SHA-256 hashes. Never the events themselves.
• Loyal Hub Only when you connect the site — pairing details (address, name, installation id, a hash of the licence key, versions); a request every 5 minutes for signed actions, with each result; and an hourly status: versions, counts of open findings and of vulnerable or updatable plugins and themes, backup dates and sizes (no paths or file names), the uptime summary, whether Under Attack Mode is on and which actions the site allows. Never users, content, files or visitor data. The owner’s signing keys are fetched from our licence server, never from Loyal Hub.
• Services you configure — Cloudflare (your API token and zone, and the addresses being blocked), Spamhaus DROP (a plain download, nothing sent), PagerDuty, Opsgenie and webhooks (the alert), and S3-compatible storage you own (backup archives, database exports and, with audit log protection, audit entries). Their own terms apply.

What is stored locally

The plugin stores a fair amount — all of it in your database and filesystem, on your own server:

• Audit log — security events with the acting user, source IP, proxy chain and request context. 90-day retention by default; configurable.
• Live Traffic buffer — a short rolling window of recent requests, including IP and user agent.
• Firewall logs — blocked requests and the rule that matched.
• Scan results and integrity baselines — file paths and hashes.
• Quarantine store — files moved out of the site, retained so a false positive can be reversed.
• Backups — full copies of your files and database, wherever you configured them to be written.
• 2FA secrets, backup codes and trusted-device records for enrolled users.

GDPR & personal data

For data the plugin stores on your server, you are the controller — it is your database. Where an opt-in feature sends data to our services, we act as a processor for that specific, disclosed purpose, and only after you have consented.

• Lawful basis — security logging is normally justified as legitimate interest: you cannot secure a site you cannot audit. The opt-in features above rely on consent instead, which is why they are off until you enable them.
• Data minimisation — telemetry and AI evidence bundles pass through a redactor before transmission, and neither carries full request bodies.
• Retention — audit retention is configurable, with automatic pruning past the window you set.
• Consent withdrawal — every consent-gated feature can be switched off from the dashboard, and transmission stops at once.
• Subject access & erasure — audit records export to CSV to satisfy an access request, and log entries can be pruned for erasure.

Deletion & uninstall

Deleting the plugin treats two categories of change differently, on purpose:

• Server-level changes are always reverted — the firewall prepend, generated .htaccess and Nginx rules, and wp-config markers. Always, regardless of settings, because orphaned rules could break a site that no longer has the plugin to manage them.
• Security data is kept by default — logs, scan history and settings survive so a reinstall resumes where you left off.

For a complete wipe, enable Delete all data on uninstall in Settings before removing the plugin. Once it is deleted, the uninstall routine can no longer run. Note that backup archives already written to disk are yours — delete them yourself if you want them gone.

This website

loyalsecuritywp.com is a static marketing site. It uses Google Analytics (GA4) to see which pages are useful, and nothing else in the way of advertising or profiling.

Cookies this site can set, once you've consented to analytics:

Google Analytics data is processed by Google under its own privacy policy and, where applicable, the Google Ads Data Processing Terms. IP addresses are truncated/anonymised by Google Analytics before storage. Data is retained in our GA4 property for 14 months and then automatically deleted.

Other third-party resources the pages load regardless of consent, for completeness:

• Google Fonts — typefaces are fetched from fonts.googleapis.com and fonts.gstatic.com, which means Google receives your IP address and user agent as part of that request. This happens on every page load and is not gated by the analytics banner — it's a same-category third-party request but not a tracking cookie.
• CDN-hosted libraries — the animation and styling libraries on the home page load from cdnjs.cloudflare.com and cdn.tailwindcss.com, with the same consequence.

Standard web server access logs are kept for operational and security purposes and are not used to profile visitors.

Your rights under GDPR (Articles 15–21) apply to the data Google Analytics collects about you on this site: access, rectification, erasure, restriction, and objection. Since data is processed under Google's account, the most direct route for erasure/objection is opting out at the browser level (reject the cookie banner, or install Google's Analytics opt-out add-on); for anything else, contact us below and we'll action it with Google as processor.

Contact

Privacy questions: [email protected]. Security vulnerabilities go through the disclosure policy instead, not this address.

This disclosure describes Loyal Security 1.5.2 and Loyal Security Pro 1.10.9. Material changes are noted in each plugin's changelog, published with each release.