WPSecureOps

Privacy

What WPSecureOps collects

You are asking a client to let a plugin report on their site's security posture. This page states exactly what that plugin sends, what it never sends, what is stored here, and how to have it removed. It describes what the software actually does, not what it might do.

Who operates this service

WPSecureOps is operated by [operator legal name and address to be completed]. Questions about data handling go to the contact page.

What the connector sends from a WordPress site

The WPSecureOps Connector runs on an enrolled WordPress site and forwards completed Wordfence scans. Each report contains only:

  • The site's name and URL, as WordPress reports them
  • WordPress, Wordfence and connector version numbers
  • A generated installation identifier, so repeated reports from the same install are recognised
  • The scan's completion time and whether it succeeded or failed
  • For each finding: its Wordfence type, numeric severity, state, title and description

What it never sends

The following never leave the WordPress site, because the connector does not read or transmit them:

  • WordPress usernames, passwords or password hashes
  • Wordfence licence keys or any API credentials
  • The contents of any file, including files a finding refers to
  • Database contents, posts, comments or customer records
  • Visitor traffic, IP addresses or analytics of any kind
  • The raw Wordfence issue object

Finding titles and descriptions are stripped of HTML, and the site's absolute filesystem path is replaced with [site-root]/ before the report is queued — so a finding about /home/someclient/public_html/wp-config.php leaves the site as [site-root]/wp-config.php. Reports are sent over HTTPS only; the connector refuses a plain-HTTP endpoint.

What is stored here

Reports are held in a single database on the server that runs this service. It contains the enrolled sites, their scan events, the findings within them, and whether you have acknowledged or dismissed each one. Older events are kept rather than overwritten, because that history is what produces the "first seen" and "occurrences" figures in the console.

API keys are never stored in readable form — only a SHA-256 fingerprint, which is enough to check a key but not to reconstruct one.

Account data

An account holds an email address, an optional display name, a role, and a connect code. If you sign in with Google, WPSecureOps receives your email address, your name and Google's stable account identifier — nothing else, and no access to anything in your Google account. If you sign in with a password, only a scrypt hash of it is stored.

Cookies

Two cookies, both strictly necessary and neither used for tracking:

  • Session cookie — set when you sign in, expires after 12 hours, HttpOnly and SameSite=Lax
  • Sign-in state cookie — set only during a Google sign-in, lives 10 minutes, exists to prevent request forgery

There is no analytics, no advertising and no third-party tracking on this site. The public pages set no cookies at all.

Third parties

  • Google — only if you choose to sign in with Google, and only to authenticate you.
  • Google Fonts — the typefaces on these pages are requested from fonts.googleapis.com, which means your browser's IP address reaches Google when a page loads. If that matters for your jurisdiction, the fonts can be served from this server instead; ask and it will be changed.

Nothing is sold, shared with advertisers, or used to train anything.

Deleting data

Removing a site from Manage sites deletes that site along with every scan event, finding and triage state belonging to it. The deletion is immediate and cascading — there is no soft-delete and no archive copy. Deactivating the connector on a WordPress site stops any further reports at source.

To have an account and its data removed, ask through the contact page.

Changes

If what the software collects changes, this page changes with it. It describes the system as it currently behaves rather than reserving rights to collect more later.