Privacy Drift monitors technical privacy changes on WordPress sites and explains them in plain language.<\/p>\n\n
It helps answer:<\/p>\n\n
The browser scan observes runtime requests and browser-visible cookie\/storage names without collecting cookie or storage values. The first scan becomes a trusted baseline; later scans show added and removed findings.<\/p>\n\n
Privacy Drift is a technical monitoring aid. It is designed to help website administrators identify privacy-relevant technical changes. It does not create, automate, certify or guarantee legal compliance.<\/p>\n\n
The rejection test is a technical behaviour check. It loads a fresh page state in a sandboxed same-site browser frame, searches for a supported or unambiguous consent-banner Reject\/Decline action, captures third-party activity before the choice, clicks Reject, waits for the page to settle and captures the resulting resources plus browser-visible cookie\/storage names.<\/p>\n\n
Results distinguish external resources observed before Reject, after Reject and newly appearing after Reject. Known analytics\/advertising services and common analytics\/advertising cookie names receive higher attention.<\/p>\n\n
If Privacy Drift cannot safely identify a Reject action, it reports that limitation instead of guessing.<\/p>\n\n
A successful rejection test is not a legal GDPR compliance verdict. It is technical evidence that can reveal obvious consent regressions such as analytics or advertising activity appearing before or remaining after a rejection action.<\/p>\n\n
Privacy Drift follows a local-first approach for its core monitoring features.<\/p>\n\n
Administrators remain responsible for the privacy implications of the WordPress site being scanned, including third-party services already configured on that site.<\/p>\n\n
Open Privacy Drift \u2192 Privacy & Data Flows for the full storage inventory and RDAP permission controls. Baseline and latest scan are replaced when approved or scanned respectively; history and audit log retain up to 100 entries each, Expected classifications up to 250 entries, and host intelligence up to 100 hosts. The latest consent-test result and local browser-scan counter are also retained. There is no automatic time-based expiry. URLs, hostnames, resource types, cookie\/storage names, timestamps and technical results can be stored; URLs may contain personal information already present in the inspected website's paths or query strings. Avoid testing pages containing sensitive personal data unnecessarily.<\/p>\n\n
Audit events associate actions with a WordPress user ID without copying the user's display name into new events. Administrator-linked acknowledgement, onboarding and RDAP permission metadata are local. WordPress personal-data export includes this metadata and that user's audit entries. Erasure removes the metadata and anonymizes their identity in retained technical audit events, including legacy copied names; it does not erase unrelated site-wide technical findings. Privacy Drift also supplies suggested text to the WordPress Privacy Policy Guide for the site operator to review and adapt.<\/p>\n\n
Temporary administrator view state (scroll position and expanded review\/history details) uses the browser tab's sessionStorage under privacyDriftExpectedViewportV1 and privacyDriftHistoryViewportV1. It is removed after restoring the view or when the tab session ends. It is not telemetry; uninstall cannot clear storage in an already open browser tab.<\/p>\n\n
RDAP.org is the only third-party research service initiated by the Free plugin. A Research host action without current permission opens a disclosure before any external lookup:<\/p>\n\n
Google, Meta, Stripe, Hotjar, HubSpot, YouTube, Maps and other service signatures are local classification rules, not requests to those companies.<\/p>\n\n
Automated external notifications and email alerts are not part of the Free version.<\/p>\n\n
Administrative mutations use WordPress capability checks and nonces. Browser-scan targets are restricted to the current WordPress site. Scan frames are sandboxed, do not permit top-level navigation, and use a no-referrer policy. Host research uses WordPress safe HTTP requests and only runs on demand.<\/p>\n\n
Because browser-grade inspection intentionally executes the site's own front-end JavaScript to observe runtime behaviour, administrators should only run browser\/consent scans on the WordPress site they intend to inspect. Privacy Drift does not load arbitrary third-party scan targets in the admin frame.<\/p>\n\n
Privacy Drift deliberately reports uncertainty where a technical result is not sufficient for a legal conclusion.<\/p>\n\n
The first time each WordPress administrator opens Privacy Drift after installation or reactivation, the plugin displays a blocking scope modal explaining that findings are technical indicators rather than legal conclusions and that Privacy Drift does not guarantee regulatory compliance.<\/p>\n\n
The administrator can acknowledge the notice with \u201cGot it \u2014 continue\u201d. The acknowledgement stores only a disclaimer version, activation identifier and UTC timestamp as user metadata in the local WordPress database. It does not transmit acceptance data, identity data or telemetry to the Privacy Drift operator, and it does not waive rights that cannot lawfully be waived.<\/p>\n\n
Each activation starts a new local acknowledgement cycle, so every administrator must review and acknowledge the scope again after the plugin is reactivated. Scan results, trusted baselines and monitoring history are not removed by deactivation or by this acknowledgement reset.<\/p>\n\n
For technical support, responsible security reports or questions about Privacy Drift data handling, contact: wordpress@stermole.at<\/p>\n\n
Security issues should not be published publicly before a reasonable opportunity to investigate and provide a fix.<\/p>\n\n
manage_options<\/code>) to run scans and review findings.<\/li>\n<\/ul>\n\nPrivacy Drift is currently tested against WordPress up to version 7.1. Older WordPress or PHP versions are not supported.<\/p>\n\n
Uninstallation<\/h3>\n\n
Deactivating Privacy Drift stops the plugin but keeps its stored monitoring data so it can be reactivated later.<\/p>\n\n
To remove Privacy Drift completely:<\/p>\n\n
\n- Go to Plugins \u2192 Installed Plugins.<\/li>\n
- Deactivate Privacy Drift if it is active.<\/li>\n
- Click Delete for Privacy Drift.<\/li>\n<\/ol>\n\n
WordPress then runs the plugin's uninstall routine. Privacy Drift clears its scheduled monitoring hook and removes its stored baseline, latest scan, monitoring history, audit log, Expected classifications, browser-scan count, host-intelligence cache, latest consent-test result, activation-cycle identifier, legacy Premium-waitlist state, and all plugin-specific first-use, onboarding and RDAP permission user metadata. On multisite it cleans the options and scheduled hook for every site and removes the shared plugin user metadata. Deactivation alone retains these records.<\/p>\n\n
If you may want to keep the existing baseline and monitoring history, deactivate the plugin instead of deleting it.<\/p>\n\n
Disclaimer<\/h3>\n\n
Privacy Drift is a technical monitoring and diagnostic tool intended to assist website administrators in identifying privacy-relevant technical behaviour and changes. It is not legal advice, a legal audit, a certification service, a consent-management platform, or a guarantee of GDPR, DSGVO, ePrivacy, cookie-consent or other regulatory compliance.<\/p>\n\n
No plugin can determine or provide complete legal compliance for a website. Legal obligations depend on the website operator, applicable jurisdiction, purposes and legal bases of processing, contracts, consent design, third-party services, organisational measures and facts that a technical browser scan cannot determine.<\/p>\n\n
Privacy Drift can only report technical activity it is able to observe in the tested WordPress and browser state. Results can be affected by caching, consent-manager configuration, browser behaviour, conditional loading, logged-in state, geolocation, network conditions, A\/B tests, third-party services and later site changes. A clear result does not prove that no other privacy-relevant processing exists. A warning or risk signal does not by itself establish a legal violation.<\/p>\n\n
Website operators remain responsible for reviewing the results, configuring their website and consent mechanisms correctly, maintaining appropriate privacy notices and agreements, obtaining professional advice where appropriate, and determining the legal requirements that apply to their specific website and organisation.<\/p>\n\n
Privacy Drift does not accept responsibility for legal decisions made solely on the basis of plugin output. To the extent permitted by applicable law, the software is provided under GPLv2-or-later without warranty; there is no warranty that the software will be error-free, uninterrupted, suitable for a particular legal purpose, or capable of detecting every privacy-relevant change.<\/p>\n\n
The first-use acknowledgement documents that the scope notice was presented and acknowledged for that administrator account. It is not a contract replacing applicable terms, does not constitute legal advice, and does not exclude or limit liability or statutory rights where such exclusion or limitation is prohibited by applicable law.<\/p>\n\n
Nothing in this disclaimer excludes or limits liability where such exclusion or limitation is prohibited by applicable law.<\/p>\n\n
Privacy Drift is an independent plugin and is not endorsed by, affiliated with, or sponsored by the WordPress Foundation or WordPress.org.<\/p>\n\n\n
\n- In WordPress, go to Plugins \u2192 Add New.<\/li>\n
- Install Privacy Drift from the WordPress Plugin Directory, or upload the
privacy-drift.zip<\/code> file via Plugins \u2192 Add New \u2192 Upload Plugin.<\/li>\n- Activate Privacy Drift.<\/li>\n
- Open Privacy Drift from the WordPress admin menu.<\/li>\n
- Review the first-use scope notice and select \u201cGot it \u2014 continue\u201d when you understand the stated limitations.<\/li>\n
- Run the first browser scan. The first successful browser scan becomes the trusted baseline used for later drift comparisons.<\/li>\n
- Review the detected third-party services, cookies\/storage names and any technical privacy-risk signals.<\/li>\n
- Run additional scans after relevant site, plugin, theme or consent-manager changes to see what changed.<\/li>\n<\/ol>\n\n
Privacy Drift stores scan and review data locally in the WordPress database. No account or external Privacy Drift service is required for the core plugin.<\/p>\n\n\n
0.13.10<\/h4>\n\n\n- Removed automated monitoring mail and the Premium early-access mail flow from Free.<\/li>\n
- Added per-administrator, versioned and revocable RDAP permission before external host research; removed hidden DNS enrichment.<\/li>\n
- Added Privacy & Data Flows, WordPress privacy-policy guidance and administrator-data export\/erasure, with complete multisite uninstall cleanup.<\/li>\n
- Removed inline presentation code and moved application state and local script translations to authenticated same-origin requests.<\/li>\n
- Hardened same-site redirects, response limits, input shapes, accessibility, keyboard focus and internationalization.<\/li>\n
- Added pinned coding\/static-analysis gates, distributed-package egress checks and observed runtime consent\/egress tests.<\/li>\n<\/ul>\n\n
0.13.9<\/h4>\n\n\n- Replaced direct admin CSS and JavaScript output with screen-scoped enqueued assets.<\/li>\n
- Corrected WordPress.org contributor and RDAP service disclosures.<\/li>\n
- Added release-checker regression coverage for direct style and script output.<\/li>\n<\/ul>\n\n
0.13.8<\/h4>\n\n\n- Added CI coverage for the minimum supported WordPress and PHP versions.<\/li>\n
- Hardened WordPress.org release-package validation and RDAP regression tests.<\/li>\n<\/ul>\n\n
0.13.7<\/h4>\n\n\n- Fixed PHP 8.5 deprecation notices in development regression tests while retaining PHP 8.0 compatibility.<\/li>\n<\/ul>\n\n
0.13.6<\/h4>\n\n\n- Removed the WordPress site URL from on-demand RDAP request User-Agents.<\/li>\n
- Consolidated host research into a single implementation using the distributed plugin version.<\/li>\n<\/ul>\n\n
0.13.5<\/h4>\n\n\n- Removed GET-based first-use acknowledgement status handling to satisfy WordPress Plugin Check.<\/li>\n
- Replaced the first-use notice with a local-only blocking modal that matches the Privacy Drift dashboard.<\/li>\n
- Required every administrator to acknowledge the scope again after plugin reactivation without removing scan or baseline data.<\/li>\n
- Finalized WordPress.org release hardening and package-only Plugin Check validation.<\/li>\n<\/ul>\n\n
0.13.4<\/h4>\n\n\n- Finalized WordPress.org release disclosures, minimum requirements, installation\/uninstallation guidance and compliance disclaimer.<\/li>\n
- Added a per-administrator first-use scope acknowledgement that is stored only in local WordPress user metadata and does not block plugin use or transmit data.<\/li>\n
- Clarified the local-first data model, absence of silent telemetry, on-demand RDAP.org transfer and explicit Premium early-access email data flow.<\/li>\n
- Added a support\/security contact and GPL license URI to the plugin metadata.<\/li>\n
- Hardened the WordPress Plugin Check CI path to run the official Plugin Check plugin in a pinned, reproducible Docker environment.<\/li>\n<\/ul>\n\n
0.13.3<\/h4>\n\n\n- Redesigned the dashboard information architecture so actions, informational guidance and scan results are visually distinct.<\/li>\n
- Reworked the Consent rejection test into a clearer Test & Protect card with plain-language purpose, current status and a visual explanation of why the check matters.<\/li>\n
- Added clearer result\/review labels and a direct Review changes action for non-clear baseline states.<\/li>\n
- Kept the redesign presentation-only so scan, consent, nonce, capability and persistence logic remain unchanged.<\/li>\n<\/ul>\n\n
0.13.2<\/h4>\n\n\n- Prepared the plugin for WordPress.org review with aligned release metadata and Tested up to information.<\/li>\n
- Added explicit in-product and readme disclosures for on-demand RDAP.org host research and Premium early-access email submission.<\/li>\n
- Added stricter browser-frame referrer handling and release UI\/version cleanup.<\/li>\n
- Added an official WordPress Plugin Check CI gate and marketplace distribution exclusions.<\/li>\n
- Expanded release acceptance to lint all PHP\/INC files, validate the clean ZIP layout and test the current WordPress 7.1 release line.<\/li>\n<\/ul>\n\n
0.13.1<\/h4>\n\n\n- Made GDPR\/consent technical risk signals more prominent in the plain-English result summary.<\/li>\n
- Integrated Consent rejection-test outcomes into the risk explanation while retaining a clear non-legal disclaimer.<\/li>\n<\/ul>\n\n
0.13.0<\/h4>\n\n\n- Added an automated Consent rejection test for supported and safely detectable cookie banners.<\/li>\n
- Added CMP detection for common WordPress\/enterprise consent platforms plus a conservative generic Reject\/Decline fallback.<\/li>\n
- Added before\/after Reject resource comparison and post-Reject cookie\/storage-name inspection.<\/li>\n
- Added plain-language results for clear, review, unsupported-banner and no-banner states.<\/li>\n
- Added a deliberately leaky test CMP fixture and Playwright regression coverage proving that analytics cookies remaining after Reject are flagged.<\/li>\n<\/ul>\n\n
0.12.0<\/h4>\n\n\n- Added single-page wp-admin interactions for browser scans, review actions, baseline approval, host research, waitlist signup and monitoring pagination.<\/li>\n<\/ul>","raw_excerpt":"Detect privacy drift, find new third-party connections, and test whether optional-looking tracking remains after \u201cReject all\u201d.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/359921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=359921"}],"author":[{"embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/stermole"}],"wp:attachment":[{"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=359921"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=359921"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=359921"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=359921"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=359921"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/mfe.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=359921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}