Security & privacy
Built not to break your site.
Preflight checks, fail-open behaviour and a kill switch, and no data leaves your server unless you turn it on.
Download free →THE PROBLEM
An SEO tool should never be the thing that takes your site down.
- “The last plugin we tried white-screened the site on activation.”
- “Legal wants to know what leaves our servers.”
- “If something goes wrong, I need one switch to turn it off.”
HOW IT WORKS
Security & privacy
01
Preflight, fail-open, kill switch
Preflight checks your environment before anything runs. If a check fails, your site keeps serving. INDEXPLANE_SAFE_MODE turns everything off from wp-config.php.
Read how it works →
02
Data stays on your server
Every external service is opt-in and listed below, with what it sends.
Read how it works →
03
Vulnerability disclosure
A published disclosure programme with response times. Report privately and we’ll credit you.
Read how it works →
External services
Is my data sent anywhere?
Not unless you turn it on. Every external service is listed here.
| Service | Default | What is sent |
|---|---|---|
| Checks and monitoring | Always local | Nothing. Checks fetch your own site from your own server. |
| Google Search Console | Off (opt-in) | Your site URL and OAuth token, to read clicks and impressions. |
| PageSpeed Insights / CrUX | Off (opt-in) | Public URLs you choose to test. |
| IndexNow | Off (opt-in) | Changed public URLs and your IndexNow key. |
| Slack / webhook alerts (Pro) | Off (opt-in) | Incident summaries, signed with HMAC, to the endpoint you set. |
| Tracking container checks (Pro) | Off (opt-in) | Fetches your public GTM container to compare it with your policy. |
| AI assistant (MCP) | Off (opt-in) | Only what your own assistant asks for, through your own account. |
| Licence check (Pro add-on only) | Pro add-on | Licence key, site URL and versions, for updates. Never in the free plugin. |
| FleetOps agent | Off (opt-in) | Signed intents only; agent only, hosted service not yet available. |
| Help links in wp-admin | On click only | The docs ID and plugin version in the URL. No site data. |
| Uninstall | Data kept | Two separate settings delete SEO data and the snapshot vault. |
Found a vulnerability? Report it privately to security@teamw2s.com. Disclosure programme →
PROOF
What you can check for yourself.
- The licensing SDK lives only in the Pro add-on, never in the free plugin.
- Uninstall keeps your data unless you choose deletion; the vault has its own delete setting.
- GPL-2.0-or-later: read every line.