Effective Date: July 1, 2026 Last Updated: July 1, 2026
Who We Are
Plugin Auditor is a WordPress plugin security scanning service operated at pluginauditor.com, currently offered as a beta service. When you use our service, through the web app or the WordPress plugin, we collect certain information to provide that service. This policy explains what we collect, why, how long we keep it, and what rights you have over it.
If you have questions, contact us at contact@pluginauditor.com.
What Information We Collect
When you use the web app
- Your email address and name when you create an account.
- Scan history associated with your account: the grade, score, and report link for each plugin you scan.
- Your IP address and an approximate location (country, region, city) derived from it, recorded for each scan you run — used to secure the service, prevent abuse, and understand where our users come from. See the IP Addresses section below.
When you scan without an account
- Your IP address is used to enforce the anonymous daily scan limit and prevent abuse. See the IP Addresses section below.
When you install and connect the WordPress plugin
- Your site’s URL is used to associate scans with your account and enforce usage limits.
- Your API key is the credential that links your WordPress site to your Plugin Auditor account.
- Plugin names and version numbers for plugins hosted on WordPress.org.
- Plugin ZIP archives, only for premium, private, or custom plugins not on WordPress.org, uploaded by you to run a scan. These are processed and deleted as described in How We Handle Your Plugin Code.
- Scan results returned from our servers (grade, issue summary, report link), stored in your WordPress database for display in your dashboard.
When you disconnect or deactivate the plugin
A notification is sent to our servers when you deactivate the Plugin Auditor WordPress plugin, so we can release the site association from your account. No additional personal data is sent beyond your API key and site URL, which were already on file.
How We Handle Your Plugin Code
When you upload a plugin ZIP or when we fetch a plugin from WordPress.org on your behalf, the code is handled as follows:
- The ZIP is stored in a temporary sandbox location on our server.
- The archive is extracted within that sandbox.
- The extracted code is analysed by our automated checks.
- The extracted files and the original ZIP are permanently deleted as soon as the scan completes, before your results are returned.
We do not retain, index, copy, or redistribute your plugin’s source code. The code is never stored after the scan finishes. This applies to every scan, with or without an account, including premium and private plugins you upload.
We do store the results of the scan (the grade, score, and list of flagged issues) so your report remains viewable at its permanent link. The results describe what was found; they are not your source code. For scans run without an account, these results are stored without being linked to any user.
Because we do not keep your uploaded ZIP, a scan run by uploading a ZIP in the web dashboard cannot be re-run automatically; you would upload the plugin again. Scans of WordPress.org plugins and scans triggered from a connected WordPress site can be re-run because we fetch the plugin again from its source.
How We Use Your Information
| Data | Purpose |
| IP address | Securing the service, preventing abuse, enforcing scan limits, and approximate-location analytics (via ip-api.com) |
| Site URL | Account association, rate limiting, and service delivery |
| API key | Authentication: verifying that requests come from your connected site |
| Plugin slugs and versions | Running security checks and returning a graded report |
| Plugin ZIP archives | Analyzed for the scan, then immediately deleted; never stored or shared |
| Scan results | Generating your report and storing your scan history |
| Email address | Account access, transactional emails, and optional security alerts |
We do not use your data for advertising. We do not sell your information to any third party.
Data Retention
We retain as little as we can while keeping your reports available:
- Plugin source code (uploaded ZIPs and extracted files): deleted immediately and permanently once the scan completes. Never retained, for anyone.
- Scan results (grade, score, issue list, report link): stored so your report stays viewable. Report links do not expire. For account holders, these are linked to your account; for anonymous scans, they are stored without a user link.
- IP addresses used for anonymous rate limiting: retained for up to 90 days, then automatically deleted.
- Site URL and API key: retained for the life of your account, deleted when you delete your account.
- Email address and account data: retained until you request account deletion.
We run routine database backups (twice daily, retained for about seven days). These backups include stored scan results but never include plugin source code, because the code is never written to the database. A backup may therefore contain a copy of your scan results for up to about seven days after they are created or deleted, until that backup rotates out.
IP Addresses
We record the IP address associated with each scan, whether or not you are signed in — to secure the service, detect and prevent abuse, enforce scan limits, and understand the general geographic distribution of our users. From the IP, we derive an approximate location (country, region, city); these lookups are performed by a third-party provider, ip-api.com, which receives the IP for that purpose. We process this under our legitimate interest in operating and protecting the service and understanding our audience. IP and location records are retained for up to 90 days, then deleted. We do not use IP addresses for advertising and do not sell them.
When you request a password reset, your IP address is included in the notification email to your account address. This is a standard WordPress security measure to help you identify unauthorised reset attempts.
How We Store and Protect Your Data
Our servers are hosted on CloudWays. Data in transit is encrypted using TLS. API keys are stored in hashed form and never exposed in plain text in logs or responses.
The Plugin Auditor WordPress plugin stores the following in your WordPress database (wp_options): your API key, your plan and quota information (cached locally to reduce API calls), and scan results for installed plugins (grade and report link per plugin). The plugin does not inject tracking scripts, pixels, or analytics into your site frontend and has no impact on what your visitors see.
Cookies
Web app (app.pluginauditor.com)
When you log in, the web app sets a session cookie to keep you authenticated. It is deleted when you log out or your session expires.
Marketing site (pluginauditor.com)
The marketing site runs on WordPress. If a team member logs in to the WordPress admin area, WordPress sets standard authentication cookies (wordpress_logged_in_* and wordpress_sec_*), which are cleared on logout. We do not use advertising cookies, third-party tracking cookies, or persistent analytics cookies.
Gravatar
If you have a registered account, your profile image may be retrieved from Gravatar using a hashed version of your email address. This hash is sent to Gravatar to display your avatar; if you have no Gravatar account, a default image is shown. Gravatar is operated by Automattic, Inc. See automattic.com/privacy.
Third-Party Services
- CloudWays: server infrastructure and hosting.
- ConvertKit: email newsletter, only if you subscribe; your email is shared with ConvertKit for this purpose.
We do not share scan data, plugin code, or site information with any security database, analytics provider, or third party beyond the infrastructure providers listed above.
Your Rights Under GDPR
If you are in the European Union or the United Kingdom, you have these rights regarding your personal data:
- Right to access: request a copy of the data we hold about you.
- Right to deletion: request that we delete your account and all associated data.
- Right to correction: request that we correct inaccurate data.
- Right to portability: request an export of your scan history.
- Right to object: object to processing in certain circumstances, including our IP-based abuse prevention.
Legal basis for processing: we rely on contractual necessity for account and scanning data you provide to receive the service, and on legitimate interests for IP-based rate limiting and abuse prevention. To exercise any right, email contact@pluginauditor.com. We respond within 30 days.
California Privacy Rights (CCPA)
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of its sale.
We do not sell personal information. Ever.
To submit a request, contact contact@pluginauditor.com.
Account Deletion
You can delete your account at any time. When you do, your account data, site associations, and the scan results linked to your account are removed from our active systems immediately. Because we run routine backups, residual copies of stored results may remain in a backup for up to about seven days until that backup rotates out. Your plugin source code is never affected, because it is never retained in the first place.
Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify registered users by email and update the effective date above. Continued use of the service after changes take effect constitutes acceptance of the updated policy.