# Security: what we protect, and what we don't

We'd rather tell you exactly what WranglePress does than promise you're "safe". No product can promise that.

## What changes for your site

**Visitors' page requests never reach PHP.** Your public site is served as saved files from Cloudflare's network. There is no WordPress®, no login page, no plugin and no database on the public side. A new flaw in WordPress, a plugin or PHP, like [PHP2Shell](https://wranglepress.com/learn/php2shell), has no public door to come through. The one exception is a choice you make: in forward mode, form posts are passed on to your private WordPress so its form plugin can handle them. In email mode (the default), WranglePress handles them itself.

That turns a "patch within hours" emergency into a "patch this week" chore.

## What still needs care

1. **If you keep WordPress, it still needs updates.** It still runs PHP and plugins. The difference is that only people who pass the login in front of it can reach it. If you retire WordPress, this and the next point don't apply: there's nothing left running.
2. **The old server address.** If you keep WordPress and your server can still be reached directly, by its IP address or an old hostname, attackers can skip us. Put a login (like Cloudflare Access) in front of it, or tell the server to accept traffic only from Cloudflare. Our help pages show how.
3. **Your accounts.** Use strong, unique passwords and two-factor sign-in for your domain registrar, DNS, Cloudflare, host and WordPress. Anyone who takes over those can change your site.
4. **What you publish.** If someone gets into your WordPress and adds bad content, the copy will faithfully include it.
5. **Scripts from other companies.** Analytics, chat and ad scripts still run in your visitors' browsers.

## How WranglePress itself is built

- **No passwords to your site.** The connector plugin uses its own key, which can only list pages, report the site's WordPress, PHP, theme and plugin versions, and request rebuilds. We never ask for your WordPress admin password or hosting login.
- **Signed requests.** Every request between the plugin and WranglePress is signed with your key and must be recent. Rebuild requests are accepted only once.
- **Encrypted secrets.** Connection keys and any access keys you give us are encrypted in our database.
- **Domain proof.** A domain can only be connected after its owner adds a DNS record we generate, so another account can't connect a domain whose DNS it doesn't control.
- **Form safety.** Submissions are rate-limited, size-limited and kept for 30 days. New form email addresses must confirm before they receive anything.
- **AI assistant access you control.** Assistants connect through WranglePress's MCP server only after you sign in and approve them, or with an API key you create. They act with your role, can be read-only, and can be disconnected or revoked at any time. Keys are stored only as a one-way hash.
- **Code and security reviews.** Every part of WranglePress has been through rounds of code and security review, and every high-severity finding was fixed.

## What data we store

| Data | Why | How long |
|---|---|---|
| Your account (name, email, password hash) | To sign you in | While your account is open; deleted within 30 days after you close it |
| Your sites' public pages and files | To serve your site | While the site is on WranglePress. Removing a site stops serving it at once. It's kept 30 days so you can restore it, then its builds, downloads and form submissions are deleted. Copies of individual files can stay in storage after that; email us to have them purged |
| Form submissions | So you can see them in the dashboard | 30 days |
| Billing details | Handled by Stripe; we never see card numbers | As Stripe requires |

More detail is in our [privacy policy](https://wranglepress.com/privacy).

## Reporting a problem

Found a security issue in WranglePress? Email [support@wranglepress.com](mailto:support@wranglepress.com). Please give us a reasonable time to fix it before telling others. We won't take legal action against good-faith research that avoids harming customers, their data or their sites. Our [security.txt](https://wranglepress.com/.well-known/security.txt) has the details.

---

Canonical page: https://wranglepress.com/security · Last updated 2026-10-24