# Security and your data

## What WranglePress changes

Visitors' page requests are answered with saved files, so they never reach PHP, WordPress®, its plugins or its database. A new flaw in any of those has no public door to come through. The exception is forward mode for forms: form posts are passed on to your private WordPress. Email mode keeps them away from it.

## What you still look after

1. **Keep your private WordPress updated.** It still runs PHP and plugins. Being private means you can update on your schedule, not within hours.
2. **[Make WordPress private](https://wranglepress.com/docs/private-wordpress) and close the back door,** so nobody can reach your server directly.
3. **Protect your accounts** with strong, unique passwords and two-factor sign-in for your domain registrar, DNS, Cloudflare, hosting and WordPress, and a strong, unique password for WranglePress.
4. **Watch what's published.** If someone gets into WordPress and adds bad content, the copy will include it.

## What we keep

| Data | How long |
|---|---|
| Your account and team | Until you ask us to close your account |
| Your sites' copies (builds) | While the site is on WranglePress. Removing a site stops serving it at once. It's kept 30 days so you can restore it, then its builds, downloads and form submissions are deleted. Copies of individual files can stay in storage after that; email us to have them purged |
| Form submissions | 30 days |
| Connection keys and access tokens | Encrypted, until you remove the site or the token |

We never ask for your WordPress or hosting passwords. Card details go to Stripe, never to us.

## Report a problem

Email [support@wranglepress.com](mailto:support@wranglepress.com).

---

Canonical page: https://wranglepress.com/docs/security · Last updated 2026-10-24