Purpose of this document
This document provides clarity on how this particular WordPress plugin processes and/or stores any personally identifiable information, and also separately details how it uses cookies, when, and for what purpose.
You may freely use this information as a supplement to your own Privacy and Cookies Policies that you provide to your own site users/visitors.
Further information on our WordPress plugins.
Note: this addendum is provided as-in, without warranty or guarantee, either stated or implied. You use these at your own risk and you alone are responsible for its accuracy and applicability to your particular circumstances. We may update these as we change the plugins’ functionality but it is up to you to ensure your policies are accurate and reflect your legal and compliance requirements for your site visitors and users.
Plugin: Shield Security for WordPress
Plugin Location: WordPress.org
Last Updated: 2022-03-04
Cookies
- The Shield Security plugin never stores any sensitive, personally identifiable information in any cookie at any time.
- A cookie is used to register the closure of the Shield Plugin security badge to prevent repeated display to the visitor
Cookie name:icwp-badgeState
Cookie lifetime: 1 day - In the case that the Shield Security Plugin needs to redirect a visitor or any request, it may use a cookie to prevent repeated/infinite redirect loops.
Cookie name:icwp-isredirect
Cookie lifetime: 7 seconds - For registered/logged-in users, Shield Security plugin uses a cookie to track user sessions and control display of certain in-plugin admin notices.
Cookie name:wp-icwp-wpsf(wasicwp-wpsf)
Cookie lifetime: 30 days - For all visitors and users, Shield Security uses a temporary cookie (~600 seconds) to track registration of a visitors for the purposes of identifying bots on a site. This cookie doesn’t track visitor browsing activities, personal information, IP addresses, etc. It’s sole purpose is for tracking the state of the “NotBot” system which assists Shield in determining whether a visitor is a human or a bot
Cookie name:icwp-wpsf-notbot
Cookie lifetime: 600 seconds (though this may vary slightly with ongoing development) - For all visitors and users, a temporary cookies is used to provide a nonce value for the NotBot system. This cookie is used to overcome limitations imposed by WP page caching plugins that don’t allow the updating of on-page nonce values. We send the nonce value via a cookie to ensure the client has access to the latest, valid nonce.
Again, this cookie doesn’t track anything or is linked to any users or visitors. It simply provide data required by the NotBot system to complete requests successfully.
Cookie name:shield-notbot-nonce
Cookie lifetime: 15 seconds (though this may vary slightly with ongoing development)
Data Storage
User Sessions
For logged-in users, the Shield Security plugin stores information on the username, the IP address and the time of last login and last activity.
This information is purged upon logout or data cleanup.
Audit Trail
The Shield Security plugin has an Audit Trail feature that will log the following information:
- Audit Trail message that may include email addresses.
- Originating IP address of the request.
- Logged-in username (where applicable).
For logged-in users this represents information that may be used to locate (by IP address) and identify individuals and their activity on the site.
This information is stored for security purposes by the site administrator.
This data will be retained and then automatically purged from the database after a certain time period, as determined by the site administrator.
Traffic Log
Alongside the Audit Trail, the traffic log is a useful tool to monitor the behaviour of requests of site visitors. This is critical in making important security determinations about a visitor.
This information is automatically purged by the plugin after a set time period, as determined by the site administrator, and defaults (at the time of writing) to 7 days.
ShieldNET
ShieldNET is a distributed knowledge system for the tracking of malicious web visitors and agents. The Shield Security plugin periodically shares its knowledge of IP address behaviour, predominantly malicious bots, with ShieldNET, that then disseminates this knowledge (by request) to other Shield Security plugin installations.
All information is completely anonymised and aggregated, and there is never any link made between an IP address and the site from which the IP information has been received. Therefore, there is no processing or storage of specific behaviours and personal information about an IP address and therefore no way to isolate and extract this information at any time.
The sole purpose for aggregation of this IP data is for security analysis and website security defense and protection.
If you wish to opt out of this, you may disable the ShieldNET integration entirely, under Config > General > General Options.
