WordPress Privacy Lint (GDPR / DSGVO)

Your plugin's privacy duties are not the site owner's problem. When a WordPress site gets a GDPR Art. 15 export request, WordPress walks every registered wp_privacy_personal_data_exporters callback. If your plugin never registered one, the rows in your custom table are simply not in the export, and the site owner is the one who answers for it. The same goes for Art. 17 erasure, for the raw IP you wrote into that table, and for the font stylesheet you enqueued from Google's servers.

This extension reads WordPress plugin and theme PHP and reports the 12 author-side rules below. It is a plain static check: a regex rule set, no network calls, no telemetry, nothing sent anywhere.

The 12 rules

Measured on the bundled fixtures

_fixtures/dirty.php is a 38-line contact-form plugin of the kind an AI assistant writes when you ask for "a WordPress form plugin that logs submissions". It produces 12 findings — 8 errors and 4 warnings — one per rule. _fixtures/clean.php is the same plugin with the duties met, and produces 0 findings. Those two files are the yardstick: run them yourself before you trust the rule set on your own code.

Free scope

The free check covers one file completely. Open any PHP file, run WordPress Privacy Lint: Check this file, and you get all 12 rules with the article and the fix for each hit. Nothing is hidden, watermarked, time-limited or counted down. The same 12 rules also run in the browser, with nothing installed: https://getreadystack.com/tools/wordpress-privacy-lint

Full version

The licence key adds a different axis, not a bigger slice of the same one: one run across every PHP file in the plugin, and a dated audit report (Markdown and JSON) that you keep — for the WordPress.org review reply and for your Art. 30 records. $29 once, one licence key per person or team seat, 7-day full refund. Yardstick: a DSGVO code review by a German IT-law firm is commonly billed at EUR 200 per hour. https://buy.polar.sh/polar_cl_sZ2Bgyx7lAEhKmhzceABGE3rRlKWXaJxUrjPm48Q1KV

Not what this is

It is not legal advice, and it is not a consent-banner plugin. It reads your source and tells you which of the 12 duties the source does not meet. Whether your processing has a lawful basis under Art. 6 is a question for a lawyer, not a linter.