Starts only on click

The vulnerability check runs only when you explicitly click the check button in the Known security vulnerabilities area. It is not automatically started by the general online-diagnostics setting.

What data is transmitted?

For each checked plugin, only the plugin identifier/directory name is sent to wpvulnerability.net. The installed version number, site address, and personal data are not sent.

Version comparison is local

The service response is then compared locally with the installed plugin version. Results are cached for twelve hours. A single run queries at most 60 plugins.