What the black box records —
and what it never will.
No fine print, no surprises. This page lists, in plain words, every kind of data the Vidal Forensics plugin records, where that recording lives, and exactly what it is used for.
It doesn't record for the sake of recording: everything it saves carries its reason — and every verdict can be explained, finding by finding.
✅ What it records
Only events that matter for security and evidence. Nothing else.
🔑 Security events
- Logins — successful and failed
- User accounts created or deleted
- Role and email changes on accounts
- Plugins activated, deactivated or deleted
- Theme switches
- Sensitive settings: site URL, admin email, open registration, default role, permalinks and scheduled tasks
👆 File fingerprints
For every file on the site, the plugin stores a SHA-256 fingerprint, its size and its date — the "baseline".
A fingerprint proves a file changed. It is not a copy of the file, and it cannot be turned back into one.
🧪 Checkup verdicts
Every Checkup result — Clean · Suspicious · Compromised — is written into the recording as an event of its own, so the history of verdicts can never quietly change either.
🛒 Store numbers (WooCommerce only)
Orders, status changes, refunds and price changes — order IDs and amounts only.
Never card numbers. Never your customers' personal data.
🔗 Sealed in a chain
Every event is sealed into a tamper-evident chain: each seal depends on the one before it. If anyone edits or deletes an entry, the chain verification breaks — visibly. A recording that can be quietly rewritten is not evidence. Kept only inside the same WordPress, a chain could be rebuilt by whoever fully controls that database — which is exactly why, once armed, a sealed copy also lives on our server, out of reach.
🚫 What it NEVER records
- Your pages, posts or product content
- Passwords — yours or anyone's
- Payment card or bank data
- Your visitors' personal information
- Anything your visitors type into forms
If it is not listed on this page, the plugin does not record it.
📍 Where the recording lives
🏠 On your site
In two tables of your own WordPress database. Entries that have been sent are purged after 30 days. Entries that have not been sent are never deleted — losing evidence is the one failure this plugin refuses to have.
🛰️ At our house — only if you arm it
With an Alert key, sealed copies travel to our server: the event batches, the baseline, the latest Checkup and a small "heartbeat". Retention on our side: 12 months, and every deletion is logged.
🔕 Not armed? Zero transmissions.
The free black box never calls home. It records locally, runs the Checkup locally, and says nothing to anyone. Sending only exists so the recording survives even if the site itself is wiped — and it only starts when you arm it with a key.
🎯 How the recording is used
🧪 What is "the Checkup"?
One button that answers a single question: has someone already been inside? It runs six checks:
The six checks
- Core files against the official fingerprints published by WordPress.org
- PHP files hiding in your uploads folder, where code should never live
- Admin accounts against the baseline photo — a new admin nobody approved is an alarm
- The seal chain itself — verifying nobody rewrote the recording
- Scheduled tasks that belong neither to WordPress nor to your baseline
- Open registration that hands out administrator accounts
The verdict, in plain words
- CLEAN — nothing found. The recording and the files match what they should be.
- SUSPICIOUS — something doesn't fit: a broken seal, an unknown task, a risky setting. Worth a human look.
- COMPROMISED — code where it should never be, a core file changed, or an admin account nobody can explain.
The Checkup runs free, on your site, whenever you press the button.
See it on your own site — free
The black box and the Checkup are the free plugin. Install it, press the button, read your own verdict.