Frequently asked questions
Plain answers about what the plugin does, what it doesn't do, and where the line between Free and Pro sits.
Does Personal Data Scanner work with any website, or only WordPress?
Only WordPress. It is a WordPress plugin: you install it from your own WordPress admin Plugins screen and it runs on your own self-hosted WordPress installation. It is not a hosted scanning service, a browser extension, or a SaaS product, and it does not work with Wix, Shopify, Squarespace, Webflow, or any platform other than WordPress. It requires a self-hosted WordPress site (the WordPress.org software) rather than a WordPress.com-hosted plan that disallows installing plugins.
Does any data leave my server when I run a scan?
No. Scanning runs entirely inside your own WordPress installation. The plugin makes no outbound network requests during a scan, and there is no telemetry of any kind. Findings are stored as masked values only, such as j***@example.com, so the plugin never becomes a second copy of the personal data it finds.
What does Personal Data Scanner detect?
Email addresses, phone numbers, IP addresses, IBANs validated with the ISO 13616 checksum, payment card numbers validated with the Luhn algorithm and real issuer ranges, national ID numbers for Germany, the UK, the US, Georgia, Italy, Spain and the Netherlands, labelled dates of birth, labelled name fields, and an optional health-keyword detector for the HIPAA angle. Pro adds custom detectors using your own regular expressions.
What parts of my WordPress site does it scan?
Users and user meta, comments and comment meta, posts, pages and revisions and their meta, the options table, WooCommerce orders (both HPOS and legacy storage) and customers, Contact Form 7 submissions stored by Flamingo, and WPForms entries. Pro adds the ability to scan any custom post type by name, with an explicit list of which fields to check.
Does it detect names in ordinary text, like a blog post or comment?
No, by design. Name detection in free text is noisy and produces false positives. Personal Data Scanner only reports a name where the field itself is labelled as one, such as first_name, billing_last_name, or a comment author field.
Does it work with WooCommerce High-Performance Order Storage (HPOS)?
Yes. Both HPOS and legacy post-based order storage are supported, and the mode is detected automatically.
What is the difference between the Free and Pro versions?
Free finds personal data and shows you where it is: a dashboard, a filterable findings table, a printable report, WP-CLI commands, and bulk Ignore. Pro adds the ability to act on findings: delete or anonymize them with a full audit log, define custom detectors and custom data sources, set up bulk cleanup and scheduled retention rules, look up and erase everything held about one email address for data subject requests, run scheduled scans, and export to CSV. See the full pricing comparison.
Is Personal Data Scanner a compliance guarantee, or legal advice?
No. The plugin shows you where personal data sits on your WordPress site so you can act on it. It does not constitute legal advice, and what you are required to do with the data it finds depends on your jurisdiction, your lawful basis for processing, and the applicable regulation, such as GDPR, HIPAA, or CCPA.
Does deleting or anonymizing a WooCommerce order break its accounting records?
No. Anonymizing a WooCommerce order uses WooCommerce's own personal-data removal approach where available, which strips the person while keeping order totals and tax records intact. Orders are never deleted outright from a finding; they are anonymized instead.
How large a site can it handle?
Scans run in resumable batches and never load a whole database table into memory, so the design targets sites with tens of thousands of comments, orders, or form entries without locking up the site during a scan.
Can I run scans without using the WordPress admin screen?
Yes. WP-CLI commands are included: wp pdscan scan, wp pdscan status, wp pdscan findings, and wp pdscan info, useful for automation, staging environments, and very large sites.
Can I add my own country's national ID format?
Yes. National ID formats are defined in one configuration file with a pattern, an optional checksum validator, and a confidence level, so a developer can add a country without touching the detection engine itself. Pro's custom detectors let a site owner add a pattern without touching code at all.
Is there a cost to the Free version?
No. The scan-and-report features are free and will remain free once the plugin is published on wordpress.org. See pricing for what Pro adds.