內容簡介
Apexly DSGVO-Check 外掛專為檢查 WordPress 網站的隱私合規性而設計，能夠識別未經同意的 Cookie、外部資源及安全性問題，幫助網站擁有者了解隱私風險，確保遵循相關法律規範。
【主要功能】
• 檢查未經同意的 Cookie 設置
• 確認 Google Fonts 是否從外部載入
• 監測第三方伺服器的聯繫情況
• 檢查網站是否使用 HTTPS 加密
• 驗證安全標頭的設置
• 確認法律頁面是否正確鏈接
外掛標籤
開發者團隊
原文外掛簡介
Most privacy problems on a WordPress site are not created on purpose. A theme brings Google Fonts along, a plugin drops a tracking pixel, an embedded video pulls in a third-party server. None of it is visible: the site looks exactly the same in the browser.
This plugin requests your own home page the way a first-time visitor receives it — with an empty cookie jar and no login — and then reports what actually happened.
It measures, it does not manage
The directory already has excellent consent plugins. They set a banner. This plugin measures what happens regardless of which banner is installed. That matters in practice: a misconfigured consent banner still loads trackers before consent is given, and the site owner has no way to notice. This plugin makes it visible, and therefore complements those plugins rather than replacing them.
What is checked
Cookies before consent — which cookies are set before anyone agreed, and which service each belongs to
Google Fonts — whether fonts are loaded from Google’s servers
Third-party hosts — which external servers are contacted, and therefore see your visitors’ IP addresses
Encryption — whether the site runs over HTTPS
Security headers — Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy
Legal pages — whether the imprint and privacy policy are linked from the home page, as German law (§ 5 DDG) requires
WordPress version — whether it is exposed in the page source
Usernames — whether account names can be enumerated through the REST API without logging in
Every finding names the concrete evidence — which cookie, which host, which version — explains in one sentence what it means, and says what to do about it.
No data transfer
The plugin requests only the site it is installed on. It contacts no external server, at no point, for no purpose. There is no account, no API key, no licence check and no usage statistic. A search for http:// or https:// in the source code returns only the licence URL and the author’s website in the plugin header — no external address is ever requested. Results are stored in a single option in your own database and removed on uninstall.
No restrictions
Every finding is shown in full. You can run the check as often as you like. There is no locked feature, no counter, and no paid version required to see the result.
What the plugin cannot do
It checks when you open it. It cannot watch continuously — that would require something running all the time. If you would rather be notified automatically when something regresses, Apexly does that. You do not need it for this plugin.
Language
The interface is in German because the plugin deals with German and EU legislation (TDDDG, DDG, GDPR) and the guidance references specific German provisions. Translations are welcome.
Not legal advice
The check describes technical findings, names the provisions involved — § 25 TDDDG for cookies, § 5 DDG for the imprint, Art. 32 GDPR for encryption — and suggests technical steps.
That is general information, not legal advice. Whether and how a provision applies to a particular case can only be assessed by a lawyer, and the same is true for the question of whether implementing a step settles the matter. The plugin does not replace a review by a supervisory authority either.
External services
This plugin does not use any third party or external service.
It sends no data anywhere. The plugin contains exactly one HTTP call (wp_remote_get, in includes/class-apexds-pruefung.php). It is used twice, both times against the site it is installed on: the home page (home_url( '/' )) and the site’s own REST route (rest_url( 'wp/v2/users' )). Both go to your own domain. There is no account, no API key, no licence check, no telemetry and no update server of our own.
A note on the domain names in the source code: the file includes/class-apexds-pruefung.php contains a list of host names such as fonts.googleapis.com, connect.facebook.net, js.stripe.com and cdnjs.cloudflare.com. These are search patterns, not requests. The plugin scans the HTML of your own page for these strings in order to report “your site loads Google Fonts” or “your site embeds a Meta pixel”. Detecting an external service requires knowing its address; the plugin never contacts any of them. The same applies to the cookie name patterns in the same file.
Security
Found a security issue? Please tell us — we answer within 48 hours and let you
know what we do and by when.
Contact: [email protected]
Please include what you have: which version, what happens, how to reproduce it,
and what an attacker could achieve. If you would like to be credited once the
issue is fixed, say so — and if you would rather stay anonymous, that is fine too.
We ask you to stay on your own site, change and delete nothing, and give us time
before publishing. Ninety days is customary; if you need it faster, talk to us.
We do not pay bounties. Apexly is a one-person business, and a programme we could
not sustain would be dishonest.
If a vulnerability in this plugin is ever actively exploited, we report it within
24 hours to the competent national CSIRT and inform users of what they can do —
as required by Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act),
which applies from 11 September 2026.
Full policy: https://apexly.de/sicherheit-melden.html
Machine-readable: https://apexly.de/.well-known/security.txt
