404ops
Menu
ProductsServicesPricingCase studiesBlogAboutContact
404ops WordPress Suite

AI privacy in the WordPress plugins

AI requests run from your WordPress server to the connection selected for that feature. You bring the provider account and, where required, its API key. 404ops does not relay these model requests through a 404ops AI service. Content sent to a hosted provider leaves your server.

Your choice of endpoint matters

Many plugins share the AI Connection screen; some adapters have their own provider choices. Check the installed plugin's settings and readme. Connecting a provider can enable scheduled or event-driven processing as well as buttons you press. A connection test sends a fixed test request; it still contacts that provider.

With a self-hosted model and endpoint you control, processing can stay on that infrastructure. The name Ollama or an OpenAI-compatible URL alone does not establish local processing: a remote host, gateway or cloud model can forward data elsewhere. Review the actual host, model and deployment. OpenRouter routes requests to the selected model provider, so review both parties.

Personal data and redaction

Some features send personal data, including comments, email or submitted messages. Redaction differs by feature and is not a guarantee that every identifier is removed. Use available previews, minimize source material, check department/access controls, and tell affected people about processing before enabling it. AI output can be wrong and needs review.

Provider policies and DPA considerations

The site operator must assess its purpose and legal basis, the people whose data it processes, and the chosen provider's applicable agreement, data-processing addendum, subprocessors and transfer terms. A plugin purchase does not establish a provider agreement. This technical page is not an executed DPA, legal advice or a compliance certification.

Retention, training use, region and controls depend on the provider, account, endpoint and settings. We do not promise a universal retention period, no training, or a particular processing region. Consult the current official sources and your account's terms:

For a custom or self-hosted endpoint, review that operator's arrangements, logs, backups and network paths. Contact 404ops about contractual questions specific to 404ops; do not send licence keys, API keys or sample personal data in an enquiry.

Other network traffic

AI is only one external data path. Payments, mail delivery, storage, embedded content, scanning, remote sources and configured alerts have separate destinations. Pro activation, revalidation and eligible update checks contact the 404ops licensing service using licence and site/product identifiers; they are separate from model requests. Read the installed Free and Pro editions' External Services sections for the complete feature-specific account.

Per-plugin disclosure

Reviewed 24 October 2026. These source snapshots describe the reviewed editions; compare them with the version installed on your site. A source reference is not an automatic check of your installation.

404ops Security Suite

The companion reads local configuration and saved observations; its checklist sends no model request and opening it initiates no external request or scan. Separate installed components may send data to a configured AI provider or network service when their own features are invoked or enabled. Their settings, provider accounts and disclosures apply independently; Security Suite does not enable those features.

Reviewed source 940752cc38a6

404ops AI Agent Connector

The Free connector has no built-in model request: agents connect to WordPress. The agent's operator controls whether data returned by a tool is processed by an external model. If you enable media uploads, an agent can ask the site to download an image from a public HTTPS address; Ask mode requires approval. Pro licensing and configured alert destinations are separate network paths.

Reviewed source b9d411df1f23

404ops Knowledge Base

AI drafting sends your description, selected category and language instruction. Planning can send source notes and selected existing articles. Ask AI sends the visitor's question, earlier conversation and articles that visitor may read to the connected provider. Importing from Zendesk or Help Scout and downloading article images are separate configured services.

Reviewed source 383f0b3fb6b8

404ops Data Tables

Invoked AI actions send the instruction and selected table context. Hidden rows and columns are excluded; Ask and Highlight refuse personal-data sources. Enabling the visitor Ask feature sends visitors' questions and visible table context. Remote imports, database connections, remote images and opted-in change webhooks have separate data paths.

Reviewed source ba5270faf0c0

404ops Event Calendar Tickets

AI drafting sends the draft request and selected source material to your connected provider. Pasting a draft URL fetches its page text and event metadata; a poster selected for drafting is sent to the model. Payments, meeting integrations, optional geocoding, map tiles and configured webhooks contact their own services separately.

Reviewed source 05533bc176b3

404ops Payment Forms

The AI form builder sends your typed description and a fixed form-structure instruction to the connected provider. It does not include payment records, customer data or the Stripe key; a draft needs your approval. Stripe processes payments independently of AI. Optional PayPal, CAPTCHA and outbound webhooks have their own data flows.

Reviewed source 70a6a1600028

Optional AI summaries send names and sample titles of public post types; Approval Queue review notes send the queued action's details. These go to the connected provider when those features are enabled. Requested or enabled Pro summaries send outcome/route/token-number-and-kind/queue/administrator-action counts, not raw agent text or token/application names. Approving a remote image request causes a separate image download from its public HTTPS address.

Reviewed source 56ffa743f93d

404ops SMTP Mail Relay

Requested pre-send spam-risk analysis sends the raw subject, up to 4000 body characters and local finding identifiers to your connected provider; with no connection it returns local heuristics only. Separately, requested AI diagnosis sends the subject, recipient addresses (masked by default, optionally unmasked), status, error/provider response, message identifiers and sending-domain authentication findings; it excludes message bodies and headers. Routing suggestions send sending-address/domain cohorts and delivery statistics. The enabled Pro weekly report sends aggregate volume, failure rates, bounce categories, top failing domains and authentication status. Ordinary outgoing mail, including recipients, subject, body and attachments, goes to your selected mail transport independently of AI; Pro bounce processing and alert channels are separate integrations.

Reviewed source 0950510c9d20

404ops Activity Log

When connected and enabled, the AI daily digest sends event counts by type and anomaly-flag text to your selected provider. Without that connection the overview is computed locally. The connected Pro weekly summary can also send aggregate event data. Optional WordPress checksum requests, MaxMind downloads, configured Pro event forwarding and Pro licensing are separate flows. This disclosure does not modify the submitted plugin or its archive.

Reviewed source ac9d65b5145f

404ops SSL Monitor

Requested AI explanations send the target's grade and findings, certificate expiry, weak cipher ratings and mixed-content resource addresses. Certificate probes, public-page checks, optional registration/Certificate Transparency lookups and opted-in alert channels contact their own destinations separately. These findings can reveal hostnames and resource URLs.

Reviewed source 4f42532e6996

404ops Docstore

Semantic search sends document text for embedding. Ask your documents sends the question and relevant document excerpts. Access and expiry are checked before sending; a department can forbid AI processing. Configured remote DocStore APIs and storage destinations can receive document bytes, names, metadata and search queries separately from AI.

Reviewed source 25153e0e2c4b

404ops Network Scanner

Requested AI triage sends the tool name, target and up to 4 KB of one tool's raw scan output. Pro Explain this finding sends a redacted finding. Scans, ownership checks, DNS, WHOIS/RDAP and configured alert destinations independently contact their targets or service operators; scan output can identify infrastructure.

Reviewed source 56ee65605bb6

404ops Site Options

Requested AI impact notes send the setting name/key, summary, current and proposed values, active plugin folder names and theme folder name. They do not send other settings, content or user records. Login-attempt records and cleanup undo snapshots are stored locally and have separate retention/export implications.

Reviewed source d3ea1c908987

404ops AI Content Generator

Generation sends your topic, keywords, gathered sources, brand voice and custom instructions to the selected provider; a self-critique sends the draft again. Ideas can send category names, titles and recorded search terms; refresh sends the selected post's text and dates. DuckDuckGo search is on by default during generation and discovered pages are fetched. Optional search, image generation and source integrations have separate destinations.

Reviewed source ced42ee571ac

404ops Web Embed

Requested AI embeddability explanations send the tested URL and the plugin's verdict/findings, not the page content. Separately, server-side oEmbed, warming and opt-in relay can contact embed hosts. A rendered embed connects the visitor's browser to its host, which can receive their IP address and set cookies.

Reviewed source db64477b12ff

404ops S3 Data Mover

Requested AI alt text sends the image filename, dimensions, title and caption to your connected provider; image bytes are not sent for this feature. File transfers send selected object names and bytes to your configured storage host. Serving offloaded media makes visitors' browsers contact the bucket or CDN independently of AI.

Reviewed source 5b5b0e0bac7e

404ops Cache Tester

Requested AI diagnosis sends the copyable diagnostic report: site/page URLs, WordPress/PHP/plugin versions, cache headers and statistics, debug constants, asset addresses and test results. It does not include visitor content or credentials. Measurement requests to your own pages and optional multisite rollups are separate from the model request.

Reviewed source cd1683f6ea53

404ops Backup

Enabled AI summaries send table names added/removed, row-count and size changes and anomaly flags after a backup. Explain with AI sends the previewed scrubbed failure report only after confirmation. Configured backup destinations receive the archive and manifest independently of AI; optional notifications can identify the site and backup archive.

Reviewed source cfc2e5a01768

404ops User Feedback

Draft with AI sends the subject, message, status, priority, type and submitter's email address. The draft is for review and is not sent as a reply automatically. Duplicate detection instead sends candidate subjects/messages with detected emails, IPs, phones and names replaced. Pro tag suggestions send redacted subject/message plus existing tag and department names; Pro insights send the redacted feedback you preview and confirm. Configured webhooks and normal email notifications are separate paths.

Reviewed source e4c992f4388e

404ops Upload Settings

Requested rule proposals send the current rule shape, role names and your description. Explain with AI sends the uploader role, extension, size, triggered signals and aggregate counts, excluding file contents, filenames, usernames and IP addresses. Upload enforcement and anomaly screening run locally without a model request.

Reviewed source 23e86e368b70

404ops AI Email Manager

Enabled classification sends subject, sender address/name and the first 1000 plain-text body characters, plus bounded earlier thread context when present. Summarize uses up to 2000 body characters. Attachments, HTML and raw headers are excluded. Pattern redaction is on by default; administrators can disable categories, names remain, and unusual formats may pass through. Rule proposals send the ruleset and your instructions. Requested Pro Inbox Cleanup sends folder names and metadata/excerpts for up to 100 recent messages through the same redaction: sender, subject, date, read/flagged state, classification and the first 160 body characters. A preview is available before sending. Connected mail/OAuth servers process mail independently of the model.

Reviewed source 487b65b27169

404ops AI Comment Moderation

Enabled moderation sends comment text, the commenter's display name and email address, and post title. Protected surfaces can send usernames or form name/email/message; login evaluation excludes passwords. Calibration can add corrected-comment excerpts. Optional routing or ensemble voting resends content to additional models on the same connection. Configured webhooks and Pro remote site synchronization are separate destinations.

Reviewed source 3a93c2374986