Qartvelo Company
Qartvelo Guard Docs Help and reference
Privacy and external services
Which outside services the plugin contacts and exactly what it sends.
Qartvelo Guard does not send personal data or site content anywhere. It has no account and no tracking. It contacts the services below only for the lookups named, and sends only the version numbers and file paths those lookups need. The only exception is the optional usage statistics described further down: they are off until you turn them on.
External services
| Service | Why | What is sent |
|---|---|---|
| WordPress.org checksum API (api.wordpress.org) | Official checksums of WordPress core files for your version, used to recognise original files. | WordPress version and the locale of the core package. |
| WordPress.org plugin checksums (downloads.wordpress.org) | Official checksums of installed plugins hosted on WordPress.org. | Plugin slug and version. |
| WordPress.org Subversion (core.svn.wordpress.org, plugins.svn.wordpress.org) | When you open the "What changed" view of a core or WordPress.org plugin file, or press "Restore official file", the original file is downloaded once to compare against or restore. | The file path, plugin slug and version. |
| WordPress.org downloads (downloads.wordpress.org) | Only when you run a clean core reinstall: the official package of your WordPress version and its published checksum. | The WordPress version. |
| Your webhook URL (optional) | When you set one, alerts about held files and threats are posted there. Only https addresses on public hosts are used. | The alert. Nothing is sent unless you enter a URL. |
The WordPress.org privacy policy: wordpress.org/about/privacy.
Some checks also make requests from your site to itself (the guard's live test, the uploads test, the check after a core reinstall). They do not leave your server's own address.
Usage statistics (opt-in)
You can choose to share your site address and setup details with the developer, Qartvelo Company, to help improve the plugin. It is off by default. Nothing is sent until an administrator turns on "Help improve Qartvelo Guard" on the Alerts step of the setup wizard or in Settings > General > Usage statistics, and the plugin never shows notices asking you to.
When it is sent
- When you turn it on, right away.
- Once a week after that, from a scheduled background task (on multisite from the main site only, once for the whole network). Never during a page view.
- When the plugin is deactivated or deleted, a short message without settings or counts.
- When you turn it off, one last message that only names the install, so it is marked inactive.
Messages go to https://qartvelo.com/api/qartvelo-guard/stats as JSON. The terms of use apply to them.
What is sent
| Field | Example |
|---|---|
| A random install ID, created when you opt in, and the event (opt in, weekly check-in, deactivate, uninstall, opt out) | 6f1c2a3e-..., heartbeat |
| Site address and site name (on multisite the network address and name) | https://example.com/, Example Shop |
| Versions of Qartvelo Guard, WordPress and PHP, and the plugin database version | 1.0.0, 6.8.3, 8.3.12, 5 |
| Site language | ka_GE |
| Whether the site is a multisite network, and the number of sites | false, 1 |
| Web server type and the detected hosting panel | litespeed, CyberPanel |
| Protection level and how uploads, plugin installs and new files are handled | balanced, hold_all, hold, report |
| Whether ClamAV scanning is on, Linux Malware Detect is installed and the early upload guard is active | true / false |
| Rounded counts (two significant digits): files monitored, items waiting for approval, threats found by the last scan, and the time of the last scan | 4800, 2, 0 |
| A signing key, sent once with the first message, so later messages can be checked to really come from your site | 64 random hex characters |
Never sent: email addresses, user names, file names or paths, IP addresses of your visitors, keys or passwords, or any content of your site. If your site address changes (for example a copy on a staging server), the plugin creates a new install ID, so the copy is counted as its own site.
How it is stored
- Every message is signed with the install's key; messages that are not signed with it are refused, so nobody else can send data in your site's name.
- We keep the latest details of each install and a history of its messages. The history is deleted after 180 days. An install that sends nothing for 180 days (because it was deleted, deactivated or opted out) is deleted completely, history included.
- We do not store your server's IP address. Behind Cloudflare we keep only the country it reports.
- The data is used only to see which versions, hosting panels and settings are in use and to plan fixes. It is not sold or shared.
How to opt out
Turn the switch off in Settings > General > Usage statistics and save. One last message marks the install inactive and nothing more is sent. To make sure nothing is ever sent from a server, add this line to wp-config.php:
define( 'WPCYBERSEC_DISABLE_STATS', true );To have the data of your install deleted earlier, write to us through the contact page with your site address.
Data kept on your server
- File fingerprints and reports in the plugin's database tables.
- Held files in the private quarantine folder, until you allow, deny or delete them.
- Stored copies of code files for the "what changed" view. Files that hold secrets are stored with the secrets already masked.
- The activity log, with the user and IP address of each event, kept for 90 days by default (Settings > Advanced > Data).
- Held administrator accounts record the login, email, who granted the role, the request address and the IP address.
What is never shown
Passwords, keys, salts and tokens are masked as ******** in every code view. The downloadable security report also shortens email addresses (for example j***@example.com) and hides the data folder path and webhook address, so it is safe to send.