Personal Data Scanner is in early access; this documentation describes the plugin as built and will expand once it's published on wordpress.org. Questions not covered here: support@personaldatascanner.com.

Requirements

WordPress 6.0 or newer
PHP 7.4 or newer
A self-hosted WordPress site — see the FAQ for what that excludes

Installing and activating

Upload the plugin folder to wp-content/plugins/ via FTP, or install the zip from your WordPress admin under Plugins → Add New → Upload Plugin. Activate it from the Plugins screen like any other plugin. A new Personal Data item appears near the bottom of your admin sidebar.

Installing the Pro add-on works the same way, as a second, separate plugin. Pro requires the free plugin to be installed and active first, since Pro has no code of its own for scanning — it only adds remediation on top of what Free already does.

Running your first scan

Open Personal Data → Dashboard and click Scan now. The scan runs in batches driven by your browser, so it never times out on a large site — if you navigate away, the scan pauses and picks up again from where it left off the next time you open the Dashboard while it's still running.

When it finishes, the Dashboard shows a total count and two breakdowns: by personal data type (email, phone, IBAN, and so on) and by source (Users, Comments, WooCommerce orders, and so on). Each row links to a filtered view of the Findings table.

Understanding the Findings table

Open Personal Data → Findings. Each row is one thing the scanner found: which record it's in, which field, what type of data, a masked preview of the value, and a confidence score.

Masked value — the plugin never stores or displays the raw personal data it finds, only a masked form such as j***@example.com.
Confidence — how sure the detector is. A checksum-validated IBAN or card number scores high; a phone-shaped number in an unlabelled field scores lower.
Where — click through to open the exact record (user, comment, post, order) in its normal WordPress edit screen.

Filter by source, type, confidence, or status, and search across labels and masked values. Select rows and click Ignore to mark them reviewed — an ignored finding stays ignored on every future scan until you reopen it.

The report screen

Personal Data → Report gives you an on-screen, printable inventory: total findings, a source-by-type matrix, and the individual records holding the most personal data. Useful as a snapshot for your own records or to hand to whoever asked "do you know where our personal data is."

Settings: sources and detectors

Personal Data → Settings lets you turn individual sources and detectors on or off. Every detector runs at its default sensitivity except the health-keyword detector, which is off by default since it is a low-confidence, special-category signal rather than a hard match.

WP-CLI

For automation, staging environments, or very large sites, the same scan engine is available from the command line:

wp pdscan scan — start a scan and wait for it to finish, with a progress bar
wp pdscan status — show the status of the latest (or a given) scan
wp pdscan findings — list findings, with --source, --type, --format and other filters
wp pdscan info — list every available source and detector on this site

Pro features

The free plugin only ever shows you what it found. The Pro add-on unlocks acting on it: delete and anonymize with a full audit log, custom detectors and custom data sources, bulk cleanup rules, scheduled retention rules, data subject request lookup and erasure, scheduled scans, and CSV export. See the full feature comparison and pricing.

Every Pro button is visible in the free plugin too — locked, clearly marked, and explained — rather than hidden, so you always know what upgrading would add.

Uninstalling

Deactivating the plugin leaves your data in place in case you reactivate it later. Deleting it from the Plugins screen removes its own database tables and settings. It never touches the personal data it found in your users, comments, posts, or orders — those are your site's own content, not the plugin's.

Getting help

Once the free plugin is live on wordpress.org, general support happens on its support forum there. Until then, and for anything Pro-related, email support@personaldatascanner.com.