BotBlocker works transparently and securely, collecting only the technical data needed for reliable bot and threat detection. Here is what it gathers, where the data is stored, and how your privacy is protected.
What Data Is Collected by BotBlocker?
When a visitor accesses your site, BotBlocker analyzes only the information needed for protection:
- IP address
- User-Agent (browser, OS, device info)
- HTTP headers (Accept-Language, Referer, etc.)
- Geolocation (country/region by IP)
- Technical parameters (JavaScript support, cookies, screen size, API availability)
- Behavioral factors (timing, interaction anomalies, bot fingerprints)
- Attack signatures and risk markers (if present)
No personal content, login details, or form data are collected or stored.
Where and How Is This Data Stored?
- All collected data is stored only on your own server, in the local WordPress database.
- Storage period is fully controlled by you: in BotBlocker settings, set the number of days for log retention.
- After the retention period expires, all old data is automatically and permanently deleted.
What the Log Shows
Each entry answers the question of why a visitor was checked or blocked:
- visit time and the requested URL;
- IP address, country, and region;
- User-Agent and device type;
- the check that fired: signature, ASN, PTR, language;
- the action: log entry, captcha, or block.
That is enough to sort out a disputed case, and nothing more. The visitor never sees the check: it runs in the background, and only a failed challenge shows a captcha page.
What the Log Does Not Contain
BotBlocker does not record anything that belongs to a person and their data:
- form submissions, messages, and comments;
- logins, passwords, and session tokens;
- email addresses and phone numbers;
- payment details;
- request bodies and uploaded files.
The log cannot restore a conversation, an order, or a shopping cart.
Who Can See the Records
The log lives in the site database and is open to the administrator in BotBlocker settings. No external dashboard gets access to it.
Retention and Deletion
Retention is set in days. When it runs out, old records are deleted automatically, without manual cleanup. A site with light traffic needs a few days. If you are investigating an incident, raise the period for the review and set it back afterwards.
GDPR and IP Addresses
The European Union treats an IP address as personal data. BotBlocker keeps it on the site server, limits retention, and does not pass it to third parties. Only addresses already confirmed as malicious go to the cloud.
How Does Cloud Verification Work in the Pro Version?
For advanced threat detection, the Pro version can use cloud verification:
- For regular visitors, no personal data is ever sent to the cloud; checks are anonymous and non-identifying.
- Only IP addresses of confirmed malicious bots are sent for further cloud analysis and threat sharing.
- Real visitors’ information never leaves your server, even in Pro mode.
Summary: Privacy First
- BotBlocker does not store unnecessary or personal data.
- All logs are temporary and deleted automatically as configured.
- Cloud checks in the Pro version affect only clearly identified malicious bots.
FAQ
Can I keep logs forever?
No, all data is deleted after the storage period you choose.
Does BotBlocker share visitor data?
Only the IPs of confirmed bots, and only for threat analysis, never real user data.
Is any content or form data stored?
No, only technical parameters and security events.
Is an IP address personal data?
In the EU, yes. BotBlocker keeps it locally, limits retention, and does not hand it to third parties.
What exactly goes to the cloud in Pro?
Only the IP addresses of confirmed malicious bots, with no data about real visitors.