Last updated: November 3, 2026
Who we are
BlogSafe.org publishes WordPress security tools, vulnerability data and research, and sells the paid editions of its WordPress plugins. This policy explains what personal information we collect through this website, our store and our plugins, why, and what you can do about it.
Questions or requests: privacy@blogsafe.org.
Visiting the website
Like any website, our server receives your IP address, browser (user-agent), the pages you request and when. Our hosting provider keeps these in its access logs to run and protect the server.
We do not use analytics, advertising or tracking cookies. Visitors who are not logged in receive no cookies from us. Website administrators who log in receive WordPress's standard login cookies.
The site's fonts load from Google Fonts, so your browser connects to Google's servers to fetch them.
Logging in
Our login page is protected by BlogSafe Login 360. For each login attempt it records the IP address, the username that was typed, whether that account exists, the browser (user-agent), the result and the time. Passwords are never recorded. Detailed records are kept for a short period and then reduced to daily totals per address. We use them to block brute-force attacks and to study attack patterns.
Contacting us
When you use the contact form, we receive your name, email address, subject and message by email, so we can reply. To limit spam, we briefly keep a one-way cryptographic hash of your network address for about a minute, not the address itself.
Buying a BlogSafe product
Payments are handled by PayPal. We never see or store your card or bank details. When a payment completes, PayPal sends us your name, email address, the transaction and order references, the product and the amount, and we keep that record of the sale.
We then create a license key and email it to you with your download link. We keep the license key with your name and email address so we can deliver updates, let you download the plugin again, and answer support questions. PayPal's own handling of your information is covered by PayPal's privacy statement.
Licenses and updates
When a paid BlogSafe plugin (such as Debug 360 Pro) activates its license or checks for updates, it sends blogsafe.org your license key, the website's address, the plugin name and version, and the WordPress and PHP versions. Our server also sees the website's IP address. We record each site where a license is active (address, IP address, and first and last check-in) to enforce the number of sites a license allows and to deliver updates.
The downloads page asks for your email address and license key only to find your purchase.
What our plugins send
- Free plugins, including Debug 360, send nothing to BlogSafe or anyone else. Their data stays in your own WordPress database.
- Paid plugins contact blogsafe.org only for the license and update checks described above.
- Services you connect yourself, such as Debug 360 Pro's Slack, Microsoft Teams, Discord, Google Chat or GitHub features, send data straight from your website to those services. BlogSafe never receives it, and those services' own policies apply.
Site Scanner
BlogSafe.org offers a Site Scanner that makes bounded public requests to a website address you provide and reports publicly observable security information about it.
The basic check does not ask for your email address and does not store the website address you check. To limit abuse, we keep a short-lived counter keyed to a one-way cryptographic hash of your network address, never the address itself.
The advanced check is only run after you confirm control of the website by placing a one-time verification code in a setting that only its administrator can change. When you request it, we store the website address and one-way hashes of the verification code, of a private key held by your browser, and of your network address. After the site is verified, we ask for the email address the report should be sent to and your choice of whether to receive optional security and product updates, and we store those with the request. The report is sent only to that address.
We retain advanced-check records, including the website address and email address, for operational, security, and record-keeping purposes. You may request deletion of your records by contacting privacy@blogsafe.org. If you opted in to updates, you may withdraw that consent at any time.
Only use the Site Scanner on websites you own, administer, or are otherwise permitted to assess.
Security research
BlogSafe studies attacks on websites. Some of our systems record hostile traffic they receive, such as automated scans, exploit attempts and login attacks, including the IP addresses, requested addresses, user-agents and timing involved. We use this to understand attacks and to improve our tools, and we may publish findings and aggregated statistics.
Our vulnerability pages are built from public sources such as the U.S. National Vulnerability Database; our servers fetch that data, so your browser does not contact those sources.
How we use information
We use the information above to run and secure the website, deliver what you bought, provide licenses, updates and support, answer messages, prevent abuse and fraud, meet legal and accounting obligations, and carry out security research. We do not sell personal information, and we do not use it for advertising.
Who we share it with
- PayPal, to take payments.
- Our hosting provider, which runs the servers that store this information.
- Authorities, when the law requires it, or to protect our systems and users from abuse.
How long we keep it
- Sale and license records: for as long as the license exists, and afterwards for as long as tax and accounting rules require.
- Site activation records: while the license is in use on that site.
- Login attempt details: a short period, then daily totals.
- Contact messages: as long as needed to deal with your request.
- Site Check records: as described in the Site Check section.
Your rights
Depending on where you live, you may have the right to see the information we hold about you, have it corrected or deleted, object to how we use it, or receive a copy. Some records, such as sales records, must be kept by law even if you ask us to delete them. To make a request, email privacy@blogsafe.org.
Security
We protect the information we hold with technical and organisational safeguards, including encrypted connections, restricted access and hardened servers. No internet service can be perfectly secure. To report a security problem, see our Security Disclosure page.
Changes to this policy
When we change this policy, we update the date at the top of this page.