Is WP Ghost GDPR Compliant?
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Yes, you can run WP Ghost on a GDPR-compliant site. Path changes, firewall rules, security headers and the hiding options store no personal data, and the features that do (brute force protection, the two logs and cloud storage) are optional, with settings for what they keep and for how long.
Which WP Ghost features collect personal data?
Most of WP Ghost’s features don’t collect or store any personal data at all. Path changes, the 2026 Ghost Firewall, security headers, disable options, Text and URL Mapping, and all hiding features work by modifying server configuration and HTML output. They don’t record visitor information.
The features that do collect data are:
Brute Force Protection records IP addresses of visitors who trigger login limits. This is necessary to block repeated failed login attempts and is a legitimate security interest under GDPR Article 6(1)(f).
User Events Log records usernames, IP addresses and actions of logged-in users on your dashboard. It’s stored locally in your WordPress database with configurable retention. If you enable cloud storage (Premium), a copy goes to the WP Ghost Dashboard and is deleted after 30 days.
Security Threats Log records IP addresses, country of origin, and attack details for blocked malicious requests.
Plugin Activation collects your email address when you activate the plugin license. You can skip this step entirely and the plugin works without activation (you just won’t have access to the cloud dashboard, security reports, or cloud storage).
How do I use WP Ghost without collecting any visitor data?
If you need zero data collection from your site visitors, switch off brute force protection, the Security Threats Log, the User Events Log and cloud storage. With those off, WP Ghost doesn’t record, store or send any personal data about your visitors. You still get path security, the firewall, security headers, 2FA, the hiding and mapping features and every disable option. Most WP Ghost features work without collecting any data.
What happens to data that is collected?
When data-collecting features are enabled:
Local storage: both logs are stored in WP Ghost’s own database table on your server (wp_hmwp_logs on a default install), with configurable retention. The table is removed on uninstall only when Delete Temporary Users on Plugin Uninstall is on in the Temporary Logins settings.
Cloud storage: If you enable Enable Cloud Storage for Events Log, a copy of events is sent to the WP Ghost Dashboard. Cloud data is automatically deleted after 30 days. It’s not shared with third parties and not used for marketing. All payments are handled by Paddle.com, and WP Ghost does not store billing or payment details.
The WP Ghost sidebar shows a notification whenever cloud storage is active, so site administrators can see that it’s on.
Frequently asked questions
Do I need to add WP Ghost to my site’s privacy policy?
If brute force protection or either log is on, yes. Tell your users that IP addresses and login activity are logged for security purposes. If you’ve switched off all data-collecting features, WP Ghost doesn’t collect visitor data and doesn’t need to be mentioned in your privacy policy.
Does WP Ghost use cookies?
WP Ghost itself doesn’t set tracking cookies on visitors. If you use Google reCAPTCHA for brute force protection, Google’s reCAPTCHA service may set its own cookies. If this is a concern for your GDPR compliance, use Math reCAPTCHA instead, which is built into WP Ghost and doesn’t use any external service or cookies.
Can I use WP Ghost on EU-based sites?
Yes. WP Ghost provides the controls needed for GDPR compliance: configurable data retention, opt-in data collection features, 30-day auto-deletion for cloud data, no third-party data sharing, and the ability to run with zero visitor data collection. You decide which features to enable based on your compliance requirements.
Does WP Ghost modify WordPress core files?
No. WP Ghost uses server rewrite rules and WordPress filters to change paths and block threats at runtime. No core files, theme files, or plugin files are modified. Deactivating WP Ghost restores all defaults instantly.