Find the personal data hiding in your WordPress site — before a regulator, or a customer, does.
Personal Data Scanner is a WordPress plugin that scans your users, comments, posts, WooCommerce orders and form entries for personal data, and shows you exactly where it sits. GDPR, HIPAA and CCPA aware. Self-hosted. Nothing ever leaves your server.
Requires WordPress 6.0+ and PHP 7.4+. Free tier planned for wordpress.org; Pro adds remediation.
Most WordPress sites hold far more personal data than their owners know
Old form submissions. Comment emails and IP addresses nobody ever reviewed. An IBAN pasted into a WooCommerce order note two years ago. A draft post that still names a customer. It accumulates quietly, in places nobody thinks to check — until someone asks you to prove you know where it all is.
Every place personal data actually accumulates on a WordPress site
One scan, run from your own WordPress admin, in batches that never lock up a busy site.
Users & user meta
Every registered account, including billing and shipping fields WooCommerce and other plugins attach to it.
Comments
Author name, email, IP address and content — including spam and trashed comments, and WooCommerce order notes.
Posts, pages & revisions
Content, excerpts and meta across every status, including old drafts and the revision history nobody deletes.
Options table
Serialized and JSON values plugins quietly store — API keys, notification emails, cached payloads.
WooCommerce orders
Both HPOS and legacy order storage, detected automatically. Addresses, notes, meta.
WooCommerce customers
The customer lookup table WooCommerce maintains independently of user accounts.
Contact Form 7 (Flamingo)
Every stored submission, field by field.
WPForms entries
Full entry data, matched back to the original form field labels.
Pattern-based detection, not guesswork
Every finding carries a confidence score, so the sure things rise to the top and edge cases stay visibly uncertain instead of hiding.
Email addresses
Standard pattern matching with format validation.
Phone numbers
International and common national formats.
IP addresses
IPv4 and IPv6, with private ranges scored separately.
IBANs
Validated against the real ISO 13616 checksum — not just a plausible-looking string.
Payment cards
Luhn-validated, matched against real issuer number ranges.
National ID numbers
Germany, the UK, the US, Georgia, Italy, Spain and the Netherlands, each with its own checksum where one exists.
Dates of birth
Found in labelled fields, or next to a birth-related keyword in free text.
Names
Only in fields whose name says it's a name — no noisy guessing in free text.
Health keywords
Optional, off by default: a special-category signal for the HIPAA angle.
The scanner never becomes a second copy of your data
Masked storage only
Findings store values like j***@example.com or DE89**************3000 — never the raw personal data itself.
Nothing leaves your server
The plugin makes no outbound network requests during a scan. There is no telemetry, ever.
Capability & nonce checked
Every admin action requires the manage_options capability and a verified nonce, on every form and every REST route.
Free finds it. Pro acts on it.
The free plugin is a complete, honest scan-and-report tool on its own — see the full comparison on the pricing page.
Free — Scan & Report
Dashboard totals, a filterable findings table linking straight to each record, a printable report, WP-CLI, and bulk Ignore that stays ignored on future scans.
Pro — Remediate & Automate
Delete or anonymize findings with a full audit log, custom detectors and custom sources, bulk cleanup and retention rules, data subject request lookup and erasure, scheduled scans, and CSV export.
Common questions
Does Personal Data Scanner work with any website, or only WordPress?
Only WordPress. It is a WordPress plugin that runs inside your own WordPress admin on a self-hosted WordPress site. It is not a hosted scanning service, and it does not work with Wix, Shopify, Squarespace, or any platform other than WordPress.
Does any data leave my server?
No. Scanning runs entirely inside your WordPress installation and the plugin makes no outbound requests. It stores masked values only.
Is this legal advice?
No. The scanner shows you where personal data sits. What you must do with it depends on your jurisdiction and your lawful basis for processing.