External services: Cyber & DevTools
This is the full reference for every external service the CloudScale Cyber & DevTools WordPress plugin can contact: each endpoint, the data sent and when it is sent. The plugin readme on WordPress.org carries the summary of each one.
Every service below is idle until you configure or click something; none is contacted on a default install.
- API keys: your own, stored in wp_options, sent only to that service, never to CloudScale.
- Never sent: post content, visitor data, database contents, passwords or credentials, unless a section says otherwise.
- Never on a visitor's page load, except Telegram alerts you set up (failed login, REST authentication failure, CSP report). Otherwise only a scheduled task or an administrator's action.
1. WordPress.org APIs (core, plugin and theme integrity checks)
Service: WordPress.org, https://wordpress.org
Endpoints: https://api.wordpress.org/core/checksums/1.0/, https://api.wordpress.org/plugins/info/1.0/ and /1.2/, and on downloads.wordpress.org the per-plugin checksum file (plugin-checksums/SLUG/VERSION.json) theme zip (theme/SLUG.VERSION.zip), and on Repair only release/wordpress-VERSION-no-content.zip or plugin/SLUG.VERSION.zip
Data sent: Your WordPress version and locale, or an installed plugin or theme's slug and version. No site URL, user data or credentials.
When: During a File Integrity check, Site Audit scan or Update Risk Assessor run. Off by default: nothing is requested until you switch on the scheduled File Integrity check under Security > File Integrity, or run a scan yourself.
WordPress.org Privacy: https://wordpress.org/about/privacy/ (no separate terms are published for these APIs)
2. Own-IP discovery (CloudScale whoami)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoint: https://api.cloudscale.consulting/whoami
Data sent: No parameters, body, licence key or site URL; the user agent is this plugin's name and version. The server sees only the requesting address, which is the answer.
When: At most daily, by a scheduled task or WP-CLI, only when this site cannot find its own public address locally. Off by default: it runs after you turn on CVE Alerts (Security tab). The browser asks it only on Check my address (Visitor IP Source).
3. Cloudflare IP ranges (trusted-proxy list for visitor-IP resolution)
Service: Cloudflare, Inc., https://www.cloudflare.com
Endpoint: https://api.cloudflare.com/client/v4/ips
Data sent: Nothing: a plain GET, no key or account.
When: Only after you choose Cloudflare under Protect > Visitor IP Source: on saving, then weekly. Off by default; until then the bundled ranges are used.
Cloudflare Privacy: https://www.cloudflare.com/privacypolicy/
4. OpenStreetMap basemaps (map tiles for the attack-origin map)
Service: OpenStreetMap Foundation, https://www.openstreetmap.org
Endpoint: tile.openstreetmap.org (and its a, b, c subdomains; path zoom/x/y.png)
Data sent: Tile coordinates, plus what a browser sends with any image request (IP address, user agent); nothing about the events plotted.
When: Only while an administrator views the attack-origin map on the Login Security tab, from the admin's browser, never the server. Not bundled, because a world basemap is hundreds of megabytes; the plugin FAQ explains this.
OpenStreetMap https://www.openstreetmap.org/copyright
5. CloudScale vulnerability lookup (CVE and advisory data during a security scan)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoints: https://api.cloudscale.consulting/vuln-lookup and https://api.cloudscale.consulting/v1/software-releases (sends nothing)
Data sent: One component per request: plugin/theme slug, WordPress version, or server product/version (PHP, MySQL/MariaDB, nginx/Apache, curl, ImageMagick, Redis, Memcached, SQLite). Never your hostname, site URL or plugin list.
When: During a scan or host software check you start, and daily once CVE Alerts is on (Security tab); off by default. Cached for 12 hours.
6. CloudScale breached-password lookup (optional, off by default)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoint: https://api.cloudscale.consulting/v1/pwned-range/
Data sent: First 5 hex characters of the password's SHA-1 hash; never the password or full hash.
When: On setting a password, only once you choose Warn or Block (Login tab).
7. CloudScale PHP advisories, IP reputation, virtual patch and AI model lists
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoints: https://api.cloudscale.consulting/v1/php-advisories (plus the release snapshot), https://api.cloudscale.consulting/ip-reputation-feed, https://api.cloudscale.consulting/v1/virtual-patches and https://api.cloudscale.consulting/v1/plugin-models
Data sent: Nothing. No parameters.
When: PHP advisories: every 6 hours, hourly while a release is announced, once you tick Send PHP advisory alerts (Security tab). IP reputation and virtual patches: daily, or on "Refresh now" (Firewall tab), once set to Log or Block. All off by default. Checks use cached copies only. Model list: weekly at most, once an AI key is saved.
8. Wordfence Intelligence API (optional, only when you supply an API key)
Service: Defiant, Inc. (Wordfence), https://www.wordfence.com
Endpoint: www.wordfence.com/api/intelligence/v3/vulnerabilities/scanner
Data sent: Nothing about your site; the public dataset is downloaded and matched locally.
When: Only during a security scan with a Wordfence Intelligence API key entered; never contacted without a key.
Wordfence Privacy: https://www.wordfence.com/privacy-policy/
Intelligence Terms: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
9. Anthropic Claude API (optional, several AI features)
Service: Anthropic PBC, https://www.anthropic.com
Endpoint: api.anthropic.com/v1/messages
Data sent: AI Cyber Audit: site URL; plugin, theme, PHP and server software versions; permission flags, debug settings, role counts, table prefix, wp-config.php flags, scheduled event names; usernames of administrators with a weak login or no two-factor; SSH settings, banner and fail2ban status; exposed-file check results; a homepage fingerprint; login, 2FA and application-password counts. The deep dive adds HTTP security headers, flagged PHP snippets, core-integrity and malware file paths and salts status. Site Audit: sample post titles and URLs, inactive themes, unwritable file paths, exposed folders. Site Optimizer: DB table/column names, a plugin's changelog, or text you paste. Thumbnails: your post title/summary, when chosen as image-prompt writer.
When: An AI-labelled button, "Test connection" or a scheduled scan you enabled, with Anthropic selected.
API key: Your own Anthropic key.
Anthropic Privacy: https://www.anthropic.com/legal/privacy
10. Google Gemini API (optional, several AI features)
Service: Google LLC, https://ai.google/
Endpoint: generativelanguage.googleapis.com/v1beta/models/
Data sent: Same as Anthropic above.
When: As Anthropic above, with Gemini selected.
API key: Your own Google AI key.
Google Privacy: https://policies.google.com/privacy
11. OpenAI API (optional)
Service: OpenAI, LLC, https://openai.com
Endpoints: api.openai.com/v1/responses (image prompt and AI features) and api.openai.com/v1/images/generations (the image)
Data sent: Your post title and excerpt, for the image prompt. AI features: as Anthropic above.
When: On "Generate" in the AI Image Generator with ChatGPT as prompt writer, "Test connection" on saving a key, or AI features with OpenAI selected.
API key: Your own OpenAI key.
Privacy policy: https://developers.openai.com/api/docs/guides/your-data
12. CloudScale Managed AI (optional, paid monthly subscription)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoints: https://api.cloudscale.consulting (base), then https://api.cloudscale.consulting/v1/messages and https://api.cloudscale.consulting/v1/messages-async (AI text), https://api.cloudscale.consulting/v1/images (featured image), https://api.cloudscale.consulting/v1/openai-chat (image prompt), https://api.cloudscale.consulting/checkout, https://api.cloudscale.consulting/checkout-start, https://api.cloudscale.consulting/status, https://api.cloudscale.consulting/cancel, https://api.cloudscale.consulting/refund-request, https://api.cloudscale.consulting/recover, https://api.cloudscale.consulting/recover/verify, https://api.cloudscale.consulting/contact; https://api.cloudscale.consulting/billing-portal and https://api.cloudscale.consulting/manage open in your browser on Manage card, never called by the plugin.
Data sent: The AI audit data described above. Image generator: the post title and a content summary (/v1/openai-chat), then the resulting prompt (/v1/images). For billing and Leave us a message, your email address, site URL and message typed, and any PayPal subscription reference not yet confirmed on this site. Every request carries your licence key, plugin name and version as headers. Never your own API keys.
When: AI data only while "Use Managed AI" is on and you run an AI feature. Billing data only when you click a billing button or Send message; with a license key stored, the Home tab refreshes status at most every 10 minutes. The PayPal button sends the product name, your hostname and the optional email above it, if you typed one, to /checkout-start, to follow up a failed checkout.
Stored: A per-site license key and subscription status, cached in wp_options.
13. CloudScale Active Vulnerability Verification (optional, requires the paid subscription)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoint: https://api.cloudscale.consulting/nuclei-scan
What it is: The only active test: CloudScale's servers send real HTTP requests to a site you own. No scanning tool ships with or runs from this plugin. Ownership is enforced server-side: it only ever scans the site your licence is registered to.
Data sent: Your license key, the domain to scan, and a scan id while polling. No site content, database contents, credentials or configuration.
Data received: Findings and a diff against your previous scan, cached in wp_options.
When: Only when an administrator clicks "Run Active Verification" or "Check ownership", and while polling that result. Never automatic.
14. CloudScale Fix Recipe Usage (optional, opt-in, off by default)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoint: https://api.cloudscale.consulting/remediation-event
What it is: Counts of which fix recipes are used. Off unless you tick "Help CloudScale improve these fix recipes" in Security > Quick Fixes.
Data sent: Recipe name, which button (viewed, copied, downloaded), finding severity, recipe pack and plugin versions, and your license key.
Not sent: Site URL, IP address, server paths, file contents, or anything you type into a placeholder.
When: Only while opted in, when you open, copy or download a recipe.
15. CloudScale Fix Order (optional, opt-in, off by default)
Service: CloudScale Consulting (plugin author), https://cloudscale.consulting
Endpoint: https://api.cloudscale.consulting/remediation-plan
What it is: Suggests a fix order and warns of a fix known to break sites on your WordPress version. Off unless you tick "Ask CloudScale what order to fix these in" on the Site Audit tab.
Data sent: Which checks failed, as identifiers from a fixed list, with severity and category; your WordPress, plugin and recipe-pack versions; your license key.
Not sent: Finding titles or descriptions, site URL, IP address or file contents.
Data received: An order and warnings only, never code.
When: Only while enabled, after an audit finishes.
16. PayPal API (optional, managed-AI subscription checkout)
Service: PayPal Holdings, Inc., https://developer.paypal.com
Endpoints: on api-m.paypal.com: v1/oauth2/token (access token), v2/checkout/orders (create an order, and its capture sub-path), v1/billing/subscriptions/ID (subscription status); www.paypal.com/sdk/js (browser JavaScript SDK). Sandbox mode: the same paths on api-m.sandbox.paypal.com.
What it is: Managed AI payment. Direct API calls only where wp-config.php defines PayPal credentials; otherwise checkout goes through CloudScale and only the SDK loads.
Data sent: Your email address, the amount, a reference (email and product name) and the return addresses (admin screens on your site). The SDK load carries CloudScale's public PayPal client ID.
When: Only when you initiate or check the status of a PayPal subscription on the Home tab.
PayPal Privacy: https://www.paypal.com/us/legalhub/paypal/privacy-full
Terms: https://www.paypal.com/us/legalhub/paypal/useragreement-full
17. Cloudflare API (optional: cache purge, comment rate limit, edge blocking)
Service: Cloudflare, Inc., https://www.cloudflare.com
Endpoints: api.cloudflare.com/client/v4/zones (purge_cache; /rulesets/phases/http_ratelimit/entrypoint, /rulesets/{id}/rules/; /firewall/access_rules/rules)
Data sent: Your API token, plus URLs to invalidate, one rate-limit rule (/wp-comments-post.php, 3 per 10 seconds per IP), or blocked IPs.
When: With zone ID and token: purge on publish/update or "Purge cache"; daily and on Test, one non-page URL; rule changes via buttons; Edge WAF Push (off by default) every 5 minutes.
Cloudflare Privacy: https://www.cloudflare.com/privacypolicy/
18. Telegram API (optional, alert notifications)
Service: Telegram Messenger Inc., https://telegram.org
Endpoints: api.telegram.org, Bot API methods sendMessage (alerts) and getUpdates (chat-ID lookup)
Data sent: The alert text and your site URL: PHP errors (type, file, line); failed logins, REST authentication failures, blocks and honeypot hits (username tried, IP address, country; for REST also the request method, path and user agent); scan, file integrity, CSP (blocked URL, page), performance and licence summaries; the contact form's email and message. Chat-ID lookup: only your bot token.
When: Only with your bot token and chat ID set, when one of those events happens and its alert is enabled. Chat-ID lookup only on "Fetch Chat ID".
Telegram Privacy: https://telegram.org/privacy
Terms: https://telegram.org/tos
19. GitHub / GitLab (optional, GitHub Sync feature)
Service: GitHub, Inc. and GitLab Inc.
Endpoints: api.github.com and gitlab.com (or your self-hosted GitLab host)
Data sent: Repository owner, name, branch and file path, in the URL; no token or site data (public repositories only).
When: When an editor links a code block to a file or clicks Sync, and daily, refreshing linked blocks.
GitHub Privacy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
Terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
GitLab Privacy: https://about.gitlab.com/privacy/
20. DB-IP GeoIP Database (optional, Visitor Map / Geo feature)
Service: DB-IP.com, https://db-ip.com
Endpoint: download.db-ip.com (this month's dbip-city-lite .mmdb.gz)
Data sent: Only a GET for a free monthly GeoIP database, queried locally; no IP address reaches DB-IP.
When: First on a "Download / Update GeoIP Database" click; then a scheduled task fetches each new month's file. Untick the monthly refresh to stop it.
DB-IP Privacy: https://db-ip.com/privacy.php
21. Uptime heartbeat (optional, off by default, your own endpoint)
Endpoint: An https URL you set (Activity tab), your own monitor, not CloudScale.
Data sent: Site URL, timezone, time, a one-time value, your token (bearer and signing key), plugin version, and signals: plugin active, admin count and ID hash, firewall mode, file-change count, mu-plugin hash. No names, emails, paths or IPs.
When: Every 5 minutes once on with a URL and token; while deactivated too if you install the loader. Never from a standby.
22. Your own server addresses (optional, your own endpoint)
Endpoints: Addresses you enter, never CloudScale: the alert webhook URL (Alerts tab; signed JSON alerts and weekly report),
csdt_fpm_probe_url(Diagnostics tab; its /fpm-status page) andcsdt_devtools_cf_origin_refresh_url(Thumbnails tab, Cloudflare; your own page cache).Data sent: A GET with this plugin's user agent; the origin refresh adds your host name, the page path and an X-Cache-Refresh header.
When: FPM status when you view it or run Auto-detect; origin refresh just before a Cloudflare purge. Nothing while empty.
Anything here that is unclear, or that you want in writing differently, ask.
Get in touch