# Free plugin data handling

This guide describes the plugin's handling. A website owner must also explain their own hosting, mail, CDN, retention and access practices to visitors. Optional services below have separate settings; installing the plugin does not authorize them. Free does not contact the licensed Pro service or an AI model. Optional welcome sharing and email signup contact antivirus.ai only after the respective explicit choice.

The optional review invitation keeps only a local first meaningful finished broad-scan time and up to three distinct UTC scan days. Finished jobs with limited coverage count when files or database records were checked; failed, cancelled and targeted jobs do not. Findings and scan outcomes never determine eligibility. After at least 30 days and three scan days, an administrator visiting this plugin dashboard can see at most three invitations, separated by at least 30 days. Display counts, dates and review/remind/never choices are stored per administrator and site. The review action sends no site, scan, finding or referral identifiers and uses a no-referrer redirect to the confirmed WordPress.org destination. Opening the link stops later prompts but does not prove a review was submitted. WordPress.org handles that visit under its own privacy policy. No invitation appears until existing ordinary core directory metadata or an explicit publisher-reviewed local setting confirms the destination; the plugin makes no new verification request. Help keeps the review action available after dismissal. Privacy export/erasure covers these local choices; erasure also clears dismissal and may permit a future invitation. Explicit full Data cleanup removes usage and choices. Ordinary uninstall retains them.

| Optional feature | Destination and data | Purpose and stopping |
| --- | --- | --- |
| Official integrity references (Pro also supports approved file repairs) | WordPress.org receives requested component names/versions, the core locale for core checksums, server IP and request timing. Requests use a fixed Shieldlume user-agent instead of WordPress's default site-URL user-agent. | Obtain core/plugin checksums or inspect exact-version theme ZIPs locally without extracting or executing their code; Pro can obtain eligible replacements. Turn off online references to stop future jobs that require them. Existing evidence remains. |
| Vulnerability advisories | Wordfence Intelligence receives an authenticated API request and server network metadata. No source files are uploaded. | Fetch advisory information. Disconnect disables requests and removes the saved token/cache. The token is encrypted with WordPress salts; host-configured credentials take precedence. |
| Signed indicators | The explicitly configured publisher shown in Protection receives protocol/version metadata and server network metadata, without inventory, findings or samples. | Download authenticated hash rules. Stop downloads to reject in-flight results; local snapshots still expire, while anti-rollback records remain. No publisher is bundled. |
| Local ClamAV | A protected Unix socket on this host receives eligible file bytes, up to 2 MiB per file. This integration has no off-host file transport. | General-purpose signature assessment. Disable local engine assessment to stop future streams. The host separately manages definitions and daemon logs. |
| Emerging Threats IP reputation | `rules.emergingthreats.net` receives server IP and request timing. No visitor IPs, inventory or source files are uploaded. | Download the compromised-IP list, normally every 12 hours, for local lookup. Stopping erases the operational list and rejects in-flight results. |
| Pwned Passwords | `api.pwnedpasswords.com` receives five characters of a SHA-1 password hash, server IP and timing. It receives no password, full hash, username or email from this plugin. | Check supported administrator password flows; matching is local and padded responses are discarded. Stopping rejects in-flight results and requests cleanup of local cache records. |
| Sensitive-file exposure checks | This site's public HTTPS WordPress address and its host/CDN receive the selected path, server IP and timing. Up to 512 response bytes are compared in memory. | Check selected local filenames for public exposure. Stopping rejects in-flight results; earlier path/status/time records remain. No response content is saved or sent to antivirus.ai. |
| Notifications | The site's existing WordPress mail provider and configured recipient receive the requested notification. | Optional alerts and deliberate test messages. Disable mail notifications to stop future messages; previous delivery records follow retention. |

Provider policies: [WordPress.org](https://wordpress.org/about/privacy/), [Wordfence privacy](https://www.wordfence.com/privacy-policy/) and [Intelligence terms](https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/), [Emerging Threats/Proofpoint privacy](https://www.proofpoint.com/us/legal/privacy-policy) and [GPL2 source statement](https://community.emergingthreats.net/t/licensing-is-the-compromised-ips-list-also-open/676), [Pwned Passwords privacy](https://haveibeenpwned.com/Privacy). The configured indicator publisher's policy appears in Protection. Read [ClamAV definition management](https://docs.clamav.net/manual/Usage/SignatureManagement.html) with the host; the plugin does not configure that separate host service.

## Local records

Findings can contain file paths, hashes, selected database observations, administrator identifiers and security metadata. Encrypted Pro file recovery may contain personal data, credentials or malicious original content. Protect the recovery directory, keys and any downloaded copies. Free uses native WordPress editor links and stores no administrator-authored replacement content. Pro file-repair records bind the administrator, target, original/replacement hashes and change status.

Firewall events retain sampled rule decisions and salted path/field fingerprints, not raw IPs or submitted request values. Exact exceptions retain their local paths and reasons. Early PHP filtering keeps at most 64 sampled rule/method/time events in verified private storage. Login-throttle hashes expire after 15 minutes.

Optional endpoint limits keep at most 512 salted source buckets, valid for two minutes. Physical removal happens on the next protected request or hourly cleanup; delayed cron can delay removal. Switching limits off clears them. No browser fingerprint is collected for these limits.

Account protection stores encrypted authenticator secrets, hashed one-use recovery codes, public passkey credentials and administrator-policy grace records. QR codes are generated locally. Session review reads existing WordPress session metadata. Supported frontend sign-in forms submit second-factor responses only to this website.

Optional administrator browser approval stores a Secure, HttpOnly, SameSite=Strict cookie for up to 30 days. Local records contain a verifier hash, account/security-state binding and creation/expiry times, with at most ten active approvals per account. They contain no new email, raw IP or browser fingerprint. Revocation removes selected approvals; disabling the policy invalidates retained approvals. Expired records may remain until a subsequent account action or authorized retention review.

Breached-password checks cache an account-bound keyed fingerprint and result for up to 24 hours. Expired results are not reused. Hourly bounded cleanup deletes expired fingerprints, and withdrawal requests immediate batch cleanup. Missed cron or database failures can delay physical deletion.

Optional Pro task reminders store the chosen workflow, bounded finding/repair record references, requested interval and administrator/site binding in a local transient for seven days. They exclude approvals, file content and credentials. Forget removes the reminder; expired reminders are never reused, although WordPress transient cleanup can run later. Snooze/dismiss preferences are local administrator metadata; a 30-day snooze expires logically while permanent dismissal remains until changed or the metadata is removed. There is no conversion or usage telemetry. Default Keep retains this metadata; the separately authorized removal process can remove it.

Scans retain bounded local digests of the rules, selected settings, component inventory and reference coverage used. These hashes enable optional Pro comparisons; they cause no additional provider request and are not evidence of a clean site.

## Downloads, retention and erasure

Diagnostic downloads are owner-requested and previewable. The allowlist excludes raw source, database contents, credentials, customer records, site addresses, raw error text and absolute server paths. A separate false-positive evidence download adds hashes and rule/version metadata, not source excerpts. Nothing is submitted automatically. Metadata can still be sensitive.

Routine Free history defaults to 30 days; Pro can supply a 90-day default while preserving saved choices. Open findings, account/security records and encrypted recovery need a deliberate retention review. Stopping a feature is not a general erasure of earlier security evidence. Keep data is the default; the separately confirmed Data & uninstall workflow can remove supported local records and safe recovery files after its safety checks. The Pro early-filter bootstrap is retained to avoid breaking a configured PHP prepend path; remove the host reference before deleting it.

The WordPress personal-data exporter/eraser handles the matching notification preference. From Free 0.1.2 it also exports matching local welcome email-choice information without connection credentials and stops matching welcome email/edition sharing; it does not unsubscribe an already confirmed newsletter. Use the private email unsubscribe link for that. These tools are not a complete export or erasure of all security records. Review other personal data, retained originals, external provider records and backups through an authorized site/host retention process.

## Optional welcome choices (Free 0.1.2 and later)

### Two optional choices, at the end of setup.

In Free 0.1.5, optional tips and compatibility choices appear as the final Optional extras step after saving guided setup. No consent dialog opens automatically on the dashboard. Protection settings keeps manual access; existing connections show their review and sharing controls. Both new choices remain unchecked and independent. Skip and viewing make no welcome request. The final page and manual controls also work without JavaScript.

### Compatibility information

If you choose Help us improve compatibility, your plugin sends the displayed site domain, WordPress version, PHP version and site language to https://antivirus.ai/newsletter-api/v1/plugin-welcome/. It does not send an email address for this choice. We use the information to understand the environments we need to support. If both choices create a new newsletter request, the consented installation details and requested address are linked through the same random connection identifier. An address that is already pending or subscribed keeps its existing preferences and is not attached to another installation by this form. Reports describe an installation; they do not verify domain ownership.

### Tips, product updates and occasional offers

The separate email choice sends your editable email address and reported Free/Pro edition to the same antivirus.ai backend. It requests practical how-to guides, product news and occasional Pro offers. A requested confirmation email asks you to confirm on its linked page before newsletter messages can begin. Edition is used to avoid inappropriate Pro offers; it is a plugin report, not proof of a paid licence. Welcome-based offers require this connection to report Free within the last 14 days; a Pro report, missing report or stale report does not qualify. Reports from this connection do not establish the edition on your other sites or your purchase history. This choice does not enable purchase-based personalization, click tracking, other brands' lists, live threat alerts or paid services.

### Updates and withdrawal

While the corresponding choice remains enabled, consented installation details and edition reports can refresh at most weekly, with an additional edition update when Free/Pro status changes. No names, plugin or theme lists, source files, findings or customer records are included. A random installation identifier, protected request credential and consent revision/times support updates and withdrawal. Use Welcome choices in Protection settings to stop sharing. Installation details are deleted after the backend receives withdrawal; an unavailable connection leaves a visible pending request. Stopping sharing does not unsubscribe an already confirmed email address. Use the private preferences or unsubscribe link in your email to stop newsletter messages. A pending request created by this welcome flow is cancelled when its email choice is withdrawn.

### Retention and hosting

Installation details and edition reports expire after 90 days without an accepted update. Connection credentials and disabled-consent markers remain while either sharing choice continues reporting, then expire 90 days after the last accepted report. If cancellation reaches us before enrollment, a minimal revoked-connection marker expires 90 days after that cancellation. Details from a stopped sharing choice are removed after withdrawal is received. Unconfirmed newsletter requests expire after 48 hours and daily cleanup can take a further 24 hours. Confirmed subscriptions last until unsubscribe or at most 730 days after confirmation. Withdrawal removes the address from the live newsletter register and cancels queued marketing; protected suppression references and consent records remain up to 180 days. Previously accepted messages cannot be recalled. Newsletter delivery records, abuse controls and rotated backups have the retention described in the newsletter privacy notice. These records are handled by A.M.E.X. Internet Marketing ltd in Cyprus, on its GoDaddy VPS in the United States with Cloudflare delivery/security; outgoing email uses the existing GoDaddy-hosted mail service and relay. Providers process connection and delivery data. Local plugin records and host backups require separate retention review.

### Data and uninstall in Free 0.1.5

Keep data is the default. Deactivation and ordinary uninstall stop scheduled plugin work and retain settings, security records and the local welcome credential, without sending a removal request. Reinstalling and activating can resume sharing you previously enabled; keeping data is not withdrawal. To stop sharing first, use Welcome choices in Protection settings. The separate Stop sharing and prepare removal action requires administrator confirmation and safety checks. It withdraws welcome sharing before its credential can be removed; a failed request retains the credential so you can retry. Preparation alone does not delete security records. After arming removal, deactivate Free and wait at least two minutes. Local deletion happens only when the same authorized administrator deletes Free in WordPress within the 30-minute confirmation period and the checks still pass. An already confirmed newsletter remains subscribed until you use its private unsubscribe link.

### Protected recovery and removal limits

Delete Pro first, after resolving any enabled or pending off-site audit or monitoring withdrawal in Pro. Shared local records include security history and account-protection approvals; removing them also removes those plugin protections. Unfinished work, unreadable state, an external object cache, or configured early-filter storage that is nonempty or cannot be verified blocks automatic removal. Ask the host to remove PHP prepend references before removing the early-filter bootstrap or its storage. Only safe encrypted recovery files authenticated against this installation’s repair journal in verified private storage can be removed; pending, unknown, orphaned or unsafe entries block the operation. Host recovery keys, server configuration, external service records and backups remain outside this process. Removal does not revoke provider credentials or undo earlier repairs. Browser preferences and cookies on other devices may remain, although removed server-side approval records can no longer authorize them. One minimal local safety marker remains after removal to reject delayed writes; it contains no email address, connection credential or security evidence and is cleared on reactivation.

Read the [antivirus.ai privacy notice](https://antivirus.ai/privacy#welcome) and [newsletter privacy details](https://antivirus.ai/newsletter/privacy). For access, correction or erasure, contact support@antivirus.ai.

For the ordered removal workflow, see [Data and uninstall](docs/data-uninstall.md).

### Optional Pro browser verification

Pro restoration checks use your signed-in browser to open this site’s WordPress dashboard before and after a file change. A local challenge expires after three minutes and contains a hash of the browser-session token, never the token or an authentication cookie. The retained repair record contains the administrator identifier, exact plan/evidence binding, observation time and result. PHP does not forward your WordPress authentication cookies. An unavailable browser leaves verification pending. Recovery records are retained for deliberate review under the removal limits above.

Pro preview preferences and continuation

Preview tabs and bundled examples are local and do not record views or send findings. Explicit Get Pro, Activate your licence and Open this tool actions can retain the existing administrator/site-bound task for seven days. Hide/restore and individual suggestion preferences stay in local administrator metadata until changed or removed. The fixed Get Pro destination receives no task, finding, site or referral identifier; the browser makes the ordinary requested visit to antivirus.ai. Security settings and sharing permissions are separate.

Local review workflows in 0.1.20

Accepted-finding review dates are optional UTC dates stored with the local exception. They show reminders only: they do not expire acceptance, restore protection, run a scan or send an extra email. Filtered evidence exports are requested locally and contain the currently matching retained findings, not a historical snapshot; protect downloaded evidence. Notification links return to the related local finding, scan or account-activity screen. Queued mail attempts use durable reservations. An interrupted or uncertain handoff remains held without automatic resend; an accepted handoff does not prove inbox delivery. Already sent mail cannot be recalled.

Pro saved finding views keep up to ten names and filter selections per administrator and site in local user metadata. Search text may contain personal information. Investigation notes, next actions and UTC review dates stay in the local review record with the author's account identifier. WordPress personal-data tools export/erase the matching administrator's saved-view content and investigation annotations even when Pro is inactive; shared evidence and investigation progress remain for deliberate security review. Erasing saved views retains an empty actor/site-bound generation marker to reject old submitted forms. It contains no saved names or search text, and is removed with the account or reviewed full cleanup.

Forgetting an investigation review clears that administrator’s notes, next action, review date and reviewed evidence references. A minimal account/investigation revision marker and ordinary record timestamps remain to reject stale forms. It contains no notes or evidence digest, counts toward the 2,000-review-record limit, and is removed by reviewed full local removal. Account deletion does not automatically remove investigation security records or these markers.

The Pro client summary uses counts and coverage information. Optional agency/client labels are held only in the requested page and its printed or downloaded output; they are not saved as settings or sent to antivirus.ai. Missing or invalid counters are shown as not recorded. Reports, notes and comparison selections are local operations; they do not authorize AI or any external service. Downloaded files and browser/host backups require separate handling.
