I'm generally concerned about privacy and I've heard that with each contact to the Wordpress API for update checks and similar a lot of my blogs data is being transfered.

To get a better impression, I'd like to more specifically know which data is being transfered and when.

What's done with the information and who has access to the information? How long is it stored?

I found no information about that in the packages readme nor on the worpdress.org website so far.

  • being a good PHP programmer and WordPress contributor core.trac.wordpress.org/query?reporter=hakre I'm wondering why are you asking these questions here? I'm sure you can easily see what is send, where it goes and when it is send while WP checks for updates. Furthermore you can change it or disable it at will. – user7099 Jul 17 '11 at 21:36
  • 3
    Questioning the motivation of the questioner does not constitute an answer. Perhaps this would be better posted as a comment to the question? – Chip Bennett Jul 17 '11 at 21:41
  • 5
    @azaozz asking questions that you can figure out yourself is fine and even encouraged if such question is interesting and answers are valuable to other people. The goal of the site (and network) is not simply to answer specific questions, but to build repository of knowledge on topic. – Rarst Jul 17 '11 at 22:06
  • I'm with @Rarst here because this question is actually less a personal question albeit I'm not shy to ask around in any case. And taken the part about questioning the OPs motivation to the side, I think azaozz is making one, two points along the way: You need to actually read the source-code to find out the details and you need to modify the software prior use if you want to control that. That's actually not really news and the question covers a lot more. @azaozz: Feel free to contribute if you're able to. Did you read the question in full? – hakre Jul 17 '11 at 23:14

This does not answer the question in specific, but those are some resources regarding the question (feel free to add stuff).

Blog Articles and Discussions

WP core resources and Trac Tickets

  1. Wordpress.org Privacy Policy
  2. Trac tickets
  3. Core code snippets

Code Stubs

Questions regarding Akismet, Facebook and other Add-Ons alike that deal with personal data

  • Blogs making use of third-party tools should check the current legal situation regarding data protection while making a third-party dealing with user-input.
  • Can you as a blog owner ensure that you can fulfill your blogs users rights on their data? Like document to whom you sent their data and how to deal with deletion requests on your behalf?

International/Country specific Resources and Pointers

| improve this answer | |

Calls from core to api.wordpress.org (wp 3.2.1)

From the phpDoc blocks:

Inside head of wp_update_themes(): "A list of all themes installed in sent to WP."

  1. Themes /wp-includes/update.php > line 261-267, called on line 280 [1].

  2. Plugins /wp-includes/update.php > line 166-172, called on line 184

  3. Core /wp-includes/update.php > starting on line 22 [3]


$options = array(
    'timeout' => ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3),
    'body'          => array( 'themes' => serialize( $themes ) ),
    'user-agent'    => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )
$raw_response = wp_remote_post( 'http://api.wordpress.org/themes/update-check/1.0/', $options );
set_site_transient( 'update_themes', $new_update );


$options = array(
    'timeout' => ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3),
    'body' => array( 'plugins' => serialize( $to_send ) ),
    'user-agent' => 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )

$raw_response = wp_remote_post('http://api.wordpress.org/plugins/update-check/1.0/', $options);


$options = array(
    'timeout' => ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3 ),
    'user-agent' => 'WordPress/' . $wp_version . '; ' . home_url( '/' ),
    'headers' => array(
        'wp_install' => $wp_install,
        'wp_blog' => home_url( '/' )

$response = wp_remote_get($url, $options);
| improve this answer | |
  • Does this mean the user-agent filter is circumvented for these requests? Or does it still applies from the HTTP API? – hakre Jul 15 '11 at 14:02
  • @hakre See update [3] – kaiser Jul 15 '11 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.