How Personal Data Scanner compares to finding personal data by hand
Search wordpress.org for "GDPR" or "personal data" and most results are cookie consent banners. A couple of much smaller plugins also touch personal data detection, in narrower ways - we name them below, honestly. Here's how Personal Data Scanner compares to those, and to what most people actually do instead.
What people do today, without a scanner
Manual database search
Open phpMyAdmin or write SQL, table by table, hoping you think to check the right one - and the right serialized meta value inside it.
WordPress's built-in privacy tools
Tools > Export/Erase Personal Data looks up one email address at a time, using whatever exporters and erasers are registered.
Cookie consent plugins
Manage the cookie banner and, in some cases, generate a policy or a request form. They don't open your database.
A consultant or agency
A person manually audits your site, usually as a one-time, separately-billed engagement.
The comparison
What each approach actually covers, in practice.
Scroll to see each alternative →
| Capability | Personal Data Scanner | Manual DB search | WordPress's privacy tools | Cookie / compliance plugins | Consultant or agency |
|---|---|---|---|---|---|
| Scans for PII patterns automatically (emails, phone, IBAN, card, national ID) | ✓ 12 detector types | - only what you think to search for | - no | - no | Depends on scope |
| Covers WooCommerce orders & customers | ✓ HPOS + legacy, automatic | - only if you know the tables | Only if WooCommerce registered an exporter | - no | Depends on scope |
| Covers form entries (Contact Form 7, WPForms) | ✓ | - only if you know the tables | Only if the form plugin registered one | - no | Depends on scope |
| Finds data without already knowing who to look for | ✓ scans everything, you review the findings | - you write the query | - one address at a time | N/A | - scoped upfront |
| Confidence scoring / checksum validation | ✓ IBAN, card & several national IDs | - no | - no | N/A | Depends on the person |
| Setup time | ✓ minutes | ✓ none - nothing to install | ✓ none | ✓ minutes | - typically days to weeks for results |
| Re-run after every content change | ✓ anytime, free, WP-CLI too | - rewrite the query | ✓ yes, one address at a time | N/A | - usually billed again |
| Technical skill required | ✓ none - runs from your WordPress admin | - SQL + WordPress/WooCommerce schema knowledge | ✓ none | ✓ none | ✓ none (it's their job) |
| Data leaves your server | ✓ zero outbound requests | ✓ no | ✓ no | Varies by plugin | Depends on their process |
| Cost | ✓ free to scan; Pro from €79/yr | Your time | ✓ free, built into WordPress core | Free-to-paid tiers | Typically hourly or project-billed |
This table compares Personal Data Scanner to general approaches, not to a specific named product. Two smaller WordPress plugins do touch personal data detection more directly - see how they differ, below.
Two other WordPress plugins that touch personal data detection
In fairness, wordpress.org isn't only cookie consent banners. These two do something adjacent, in narrower ways.
Database Anonymization Free Edition
Turns a production database into an anonymized copy for developers, using rules you configure yourself - it doesn't detect PII automatically, you tell it which columns to anonymize. Built for exported SQL or dev/test copies; its own documentation warns against running it directly on production. The free edition has no built-in WooCommerce or form-plugin rules.
PIIP - PII Protection
Automatically detects and masks a wide range of PII, including credit card numbers with Luhn validation, before it's stored - a genuinely different, proactive approach. It also supports custom regex patterns for site-specific identifiers, which is not unique to us and worth saying plainly. Scoped to comments, user profiles, Contact Form 7 and a few community plugins (wpForo, BuddyPress, bbPress); it doesn't cover WooCommerce orders, the options table, posts and pages, or WPForms.
Both are real plugins solving real, narrower problems well. Personal Data Scanner's difference is breadth: all 11 sources above, including WooCommerce and the options table, scanned automatically and directly on your live site, with checksum-validated IBAN, card and national ID detection, a 12-detector built-in set, custom detectors on Pro that plug into the same dashboard and remediation as every built-in one, and a separate Pro tier for remediation. Found another WordPress plugin that does something similar? Tell us and we'll add it here.
Report it, or actually fix it
These are two different jobs, and Personal Data Scanner keeps them in two different tiers on purpose.
Free: finds and reports
Scanning is read-only. It never modifies a record on your site. Findings are stored as masked values only (j***@example.com), so the plugin itself never becomes a second copy of the personal data it finds. You get a dashboard, a filterable findings table, a printable report and WP-CLI - visibility, not action.
Pro: actually changes the data
Delete and Anonymize make a real, permanent change to the record on your site - covered in detail below. This is a materially different, higher-stakes operation than scanning, which is why it sits behind a paid tier with its own confirmation steps and audit log, rather than being one click away in the free plugin.
The details other summaries skip
Checksum-validated, not just pattern-matched
IBANs are checked against the real ISO 13616 mod-97 checksum. Card numbers pass the Luhn algorithm and are matched against real issuer prefix ranges (Visa, Mastercard, Amex, Discover, JCB, Diners, Maestro, UnionPay). National ID numbers are checked against their own checksum where one exists. A digit string that merely looks like a card number, with a failing checksum, gets a low confidence score instead of a false alarm.
Free text, not just labelled fields
Email, phone, IP, IBAN, card, national ID and API key/secret detection run against whatever text a field holds, labelled or not - an IBAN typed into a WooCommerce order note, or an AWS key pasted into a comment while someone debugs something, is still found. The deliberate exception is names, dates of birth and addresses: free-text detection for those is unreliable and noisy, so they only fire in a field whose name says what it is (first_name, billing_address_1, comment author, and similar).
Real anonymization, not pseudonymization
Pro's Delete and Anonymize actions overwrite the actual value - a whole-field placeholder (deleted@site.invalid, a zeroed IP, "Anonymous") or an inline [removed] marker for a value embedded in a larger field - with no lookup table stored anywhere that could reverse it. The audit log records only the masked value that was already on screen, never the original. WooCommerce orders go through WooCommerce's own privacy eraser, so totals and tax records survive. Deleting a standalone record - a comment, a form entry, a revision - removes the row outright. This only covers what the scanner found, though: a copy of the same data in a backup, an uploaded file, or your own sent-mail folder is outside its reach.
Runs on your live site, not an export
Scanning and remediation both happen directly inside your own running WordPress install - no SQL export, no staging copy, no column-by-column configuration beforehand. Scans run in batches of 200 records and resume automatically, so nothing times out or locks up a busy site. Every destructive Pro action - delete, anonymize, a retention rule, a bulk cleanup rule - shows a confirmation step stating plainly what it will do before it runs, and is written to the audit log.
What "automatic" actually means here
Common questions about the comparison
Is there a WordPress plugin that scans for personal data automatically?
Yes - this one. Two much smaller WordPress plugins also touch personal data detection: Database Anonymization Free Edition, which anonymizes a database copy using rules you configure yourself rather than detecting PII automatically, and PIIP - PII Protection, which does detect PII automatically, including credit cards with Luhn validation, but only within comments, user profiles, Contact Form 7 and a few community plugins. Personal Data Scanner detects automatically, with no configuration, across 11 sources including WooCommerce orders, customers, coupons and downloads, the options table, posts and pages, WPForms and Gravity Forms.
What's the difference between Personal Data Scanner and a cookie consent plugin?
A cookie consent plugin manages the banner asking visitors to accept cookies and tracking scripts going forward. It has nothing to do with personal data already stored in your database from years of form submissions, orders and comments. Personal Data Scanner scans that existing data and shows you where it sits. The two solve different problems, and most sites that need one also need the other.
Does WordPress already have a built-in GDPR data lookup tool?
Yes, partly. WordPress core has had Tools > Export Personal Data and Erase Personal Data since version 4.9.6. You type in one email address and WordPress runs every registered exporter or eraser for that address - covering user accounts and comments by default, plus WooCommerce or other plugins if they register their own. It doesn't scan for personal data patterns, it won't tell you where personal data is hiding that you didn't already know to look for, and it only ever looks up one address at a time. Pro's own data-subject-request lookup uses these same core hooks, on top of the pattern-based scan the free plugin already runs.
Do I need to hire a consultant for a WordPress personal data audit?
Not for finding where the data is - that's what Personal Data Scanner automates in minutes instead of days. You may still want legal counsel for the compliance decisions that follow: your lawful basis for processing, how long you're allowed to keep something, and your specific obligations under GDPR, HIPAA, CCPA or another regulation. The scanner shows you where personal data sits; it isn't legal advice.
Does Personal Data Scanner do real anonymization, or pseudonymization?
Real anonymization, not pseudonymization. Pseudonymization keeps a reversible link somewhere - a lookup table mapping a token back to the original value. Pro's Delete and Anonymize actions don't do that: the original value is overwritten directly in the field with a non-identifying placeholder, and nothing anywhere in the plugin stores a way to reconstruct it. The audit log itself only ever holds the masked value, never the original. The one honest caveat: this covers what the scanner found on your site, not copies of the same data sitting in a backup, an uploaded file, or an email you already sent.
Can it find a credit card number or IBAN typed into a comment, not just a labelled field?
Yes. Email, phone, IP, IBAN, card and national ID detection scan whatever text a field holds, labelled or not - so an IBAN pasted into a WooCommerce order note or a card number typed into a comment is still found. Names and dates of birth are the deliberate exception: free-text name detection is unreliable, so those only fire in a field whose name says what it is.
Does it validate the numbers it finds, or just match a pattern that looks right?
It validates. IBANs are checked against the real ISO 13616 mod-97 checksum. Card numbers pass the Luhn algorithm and are matched against real issuer prefix ranges. Several national ID formats carry their own checksum, checked the same way. A number that merely has the right shape but fails the checksum is scored at low confidence rather than reported as a match.
What doesn't Personal Data Scanner detect?
No scanning of uploaded files, logs or database backups yet, in either tier - that's a noted future direction. City, postcode and country are deliberately not scored as their own address finding, since alone they identify almost no one. Everything else on our own list, including addresses and API keys/secrets added in version 0.1.1, is covered. We'd rather say this plainly than let a comparison imply otherwise.
Can I add my own custom detection rules, like PIIP does?
Yes, on Pro - and to be fair, PIIP - PII Protection also supports custom regex patterns for site-specific identifiers, so this isn't unique to us. The difference is integration: a custom detector in Personal Data Scanner Pro plugs into the exact same findings dashboard, confidence scoring, masked storage and Delete/Anonymize remediation as every built-in detector, across all 11 sources including WooCommerce and the options table.