After-Hack Checklist

Privacy: After-Hack Checklist (free and Pro)

Last updated: 2026-10-30. Publisher: Timothée Aubourg.

Free plugin

  • Nothing sent to the publisher. The plugin sends nothing to its author. It loads no remote script or font, sets no cookie of its own, and has no tracking or analytics.
  • Requests to WordPress.org, only after you tick a box. The checkbox "Download the checksums from api.wordpress.org and downloads.wordpress.org" is unticked the first time; your choice is remembered (option ahcl_checksums_consent). When it is ticked, a check sends:
    • to api.wordpress.org, one request for the core checksums, with your WordPress version and package language;
    • to downloads.wordpress.org, one request per installed plugin, with its folder name and version;
    • to api.wordpress.org, for each plugin without published checksums, one request with its folder name, to find out whether it is on WordPress.org.

    These requests go through the WordPress HTTP API, which by default sends your WordPress version and site address in the User-Agent header; WordPress.org also sees your server's IP address. WordPress.org handles them under its own privacy policy: https://wordpress.org/about/privacy/. When the box is unticked, nothing leaves your site.

  • Read on your site: files of the WordPress folder, users and their roles and capabilities, posts and pages, scheduled tasks, settings and autoloaded options. The plugin modifies none of them.
  • Stored by the plugin, in your database only: ahcl_state (state of the current pass), ahcl_last_report (last report), both not autoloaded; ahcl_checksums_consent (your checkbox choice); transients with the downloaded checksums and plugin information, kept 24 hours. The last report can contain file paths, usernames and user IDs, post titles and short extracts (200 characters at most) of the values found. Nothing else is written.
  • Only users with manage_options (network administrators on multisite) can open the page and run a check.

Pro add-on

  • Freemius SDK, the only network calls of Pro besides the checksums. Pro embeds the Freemius WordPress SDK (Freemius, Inc., Wilmington, Delaware, United States, reseller and merchant of record of Pro). When the administrator activates the license, the SDK sends to Freemius the license key, the site address, an anonymous site identifier, the plugin and SDK versions, whether the site is a local one, and, unless the license already belongs to a Freemius account, the first name, last name and e-mail address of the WordPress administrator who activates (with their answer to the marketing e-mails question, if the screen asks it). The license activation screen lists what is shared: required, "View License Essentials" (site address, plugin version, SDK version) and "View Plugin State" (active, deactivated or uninstalled); optional, "View Diagnostic Info" (WordPress and PHP versions, site language and title), ticked by default, and "View Plugins & Themes List" (names, slugs, versions, active or not), unticked by default. The optional items can be changed later with the "Opt Out" link of Pro on the Plugins screen. Afterwards the SDK checks the license and looks for updates periodically with the data allowed above, and tells Freemius when Pro is deactivated or uninstalled. If the administrator fills in the SDK's deactivation feedback form, the reason chosen and the text typed (128 characters at most) are sent too.
  • Scheduled check: it downloads WordPress.org checksums only if the checkbox of the free plugin is ticked, with the same requests as above.
  • Snapshot: stored in the table {prefix}ahcl_snapshot of your database: file paths and checksums, users with administrator-level capabilities, option names with a hash of their value, scheduled tasks. It is never sent anywhere.
  • E-mail: sent by your own site with wp_mail(), by default to the site's administration address, only for a new anomaly or a new suspicious finding. It goes through your site's mail settings, not through the publisher.
  • HTML export: a file downloaded by the administrator who clicks the button; Pro does not send it anywhere.
  • Uninstall: deleting Pro from the WordPress admin removes its table and its own options (those of the free plugin stay). The Freemius SDK keeps its own account data in the WordPress options (fs_accounts), as Freemius designed it; to remove them, use "Delete account" on the Pro Account page before uninstalling.
  • Purchase data (name, e-mail, billing details) is handled by Freemius as reseller under its own privacy policy, not by the plugin.

Contact

  • Privacy questions: support@timaub.fr.
  • Security vulnerabilities: security@timaub.fr (see security.txt on https://timaub.fr).