1. Self-Contained Architecture & Data Collection
GeniousSonu Site Checkup is designed as a local, self-contained WordPress utility. It executes exclusively on your own web server.
genioussonu.me does not collect, receive, or store any data from plugin installations, analytics, tracking telemetry, or usage metrics.
If you use the self-hosted release build, your WordPress installation periodically checks https://www.genioussonu.me/plugin/genioussonu-site-checkup/update-info.json to determine if a newer version is available. Like any standard static file request, this reveals your requesting server IP address in standard web server access logs. The official WordPress.org directory build does not make this call; it relies solely on WordPress.org infrastructure.
2. Outbound External Services (All Strictly Opt-In)
In compliance with WordPress.org Plugin Guideline 7, all outbound network calls to external APIs are disabled by default. They require an explicit administrator opt-in toggle or checkbox in the plugin settings before running.
1. WordPress.org APIs (api.wordpress.org)
Data Sent: Current WordPress core version, installed plugin slugs, and site locale. Zero personal visitor data or credentials.
Why: Validates WordPress core files against official SHA-256 checksums and detects closed or abandoned plugins in the official directory.
Privacy Policy: WordPress.org Privacy Policy ↗
2. Patchstack Vulnerability Database (patchstack.com)
Data Sent: Active plugin and theme software slugs and version strings. Optional encrypted API token if configured.
Why: Queries Patchstack vulnerability intelligence to detect known CVEs affecting installed extensions.
Policies: Patchstack Privacy Policy ↗ · Patchstack Terms of Service ↗
3. GitHub Security Advisory Database (api.github.com)
Data Sent: Component slugs and version strings. Optional user-provided GitHub Personal Access Token in HTTPS headers.
Why: Cross-references GitHub GHSA security advisories for open-source WordPress software.
Policies: GitHub Privacy Statement ↗ · GitHub Terms of Service ↗
4. Google Open Source Vulnerabilities (api.osv.dev)
Data Sent: Software component names and versions. Zero visitor data.
Why: Queries Google distributed OSV vulnerability schema across open-source ecosystems.
Policies: Google Privacy Policy ↗ · OSV FAQ & Terms ↗
5. NIST National Vulnerability Database (services.nvd.nist.gov)
Data Sent: Component identifiers and optional encrypted NVD API key.
Why: Queries official NIST CVE data and CVSS severity scores.
Privacy Policy: NIST Site Privacy ↗
6. CISA Known Exploited Vulnerabilities (cisa.gov)
Data Sent: None. Outbound GET request fetches the public catalog JSON feed.
Why: Alerts administrators to weaponized vulnerabilities and active zero-days.
Privacy Policy: CISA Privacy Policy ↗
7. WPScan Vulnerability Database (wpscan.com)
Data Sent: Plugin/theme slugs, version strings, encrypted API key in header.
Why: Queries specialized WordPress core and extension vulnerability databases.
Data Handling Notice: In compliance with WPScan Terms of Service and data licensing, vulnerability intelligence data retrieved from WPScan is never permanently stored or cached on disk.
Policies: Automattic Privacy Policy ↗ · WPScan Terms of Service ↗
8. Optional Web-Search Enrichment
Data Sent: Public CVE identifier and software slug.
Why: Discovers published security writeups, remediation patches, and technical advisories.
Explicitly disabled by default; only runs when enabled by site administrators in Settings.
9. Outbound Event Webhooks (Slack, Discord, Custom)
Data Sent: Factual event notification payloads (timestamp, alert type, sanitized technical message).
Why: Alerts agency teams to critical incidents (brute-force lockouts, rogue admin creation).
Secret Scrubber: Webhook dispatch payloads strictly redact all passwords, authentication keys, and database salts prior to transmission.
Policies: Slack Privacy Policy ↗ · Discord Privacy Policy ↗ · Discord Terms of Service ↗
3. Data Retention & Local Database Footprint
All audit records created by the plugin reside in the local WordPress database table wp_wpsg_audit_logs. Logs are retained for a rolling 12-month period and automatically pruned to prevent database bloat. Uninstalling the plugin through the WordPress admin permanently removes all managed tables and options when the cleanup option is confirmed.
Last Updated: October 21, 2026