“No telemetry” is easy to say and hard to prove, and it’s worth being precise about what the alternative actually looks like before claiming this matters at all.
Two real, common patterns worth knowing about
A cloud-based firewall, the kind that sits in front of your site and inspects traffic before it reaches you, has to decrypt and re-encrypt that connection to do its job. That’s not a flaw, it’s how the architecture works, but it means every visitor’s traffic passes through a third party’s servers by design, every time, for as long as it’s active.
A plugin that participates in a shared threat-intelligence network, sending data from your site back to help build a wider database, is doing something genuinely useful for the ecosystem, and it’s also, structurally, sending your data somewhere. Wordfence’s brute-force protection defaults to exactly this, participating in their Real-Time Security Network, real enough that GDPR compliance guides specifically instruct site owners to go find the toggle and turn it off if they haven’t got visitor consent for that transfer.
Neither of those is a scandal. They’re trade-offs, made on purpose, for real functionality. We just made a different one.
What SecondGate actually does instead
We checked the entire free-tier codebase for every outbound connection. There are exactly two, and here’s the full, unedited request:
https://raw.githubusercontent.com/ipverse/country-ip-blocks/master/country/{code}/ipv4-aggregated.txt
https://raw.githubusercontent.com/ipverse/country-ip-blocks/master/country/{code}/ipv6-aggregated.txtRead that carefully, there’s nothing in it but a country code you already chose. No site URL, no license key, no visitor data, nothing identifying your site attached to the request. It’s a plain GET to a public GitHub file, once a day, or when you click “Refresh now” yourself. There’s no cloud proxy sitting in front of your traffic, and no network we’re building from data pulled off your site, because we never built the server that would collect it.
The crawler verification works the same way
Confirming a visitor’s really Googlebot uses a standard DNS lookup, PHP’s own gethostbyaddr() and gethostbyname(), the same kind of lookup your server’s own resolver does constantly anyway. It checks the connecting IP against public DNS. Nothing about your site or that visitor goes anywhere as part of it.
Why we’re showing you the actual code instead of just saying “trust us”
Because “we don’t collect your data” is the easiest claim in this industry to make and the hardest to verify from outside. Most people asking that question have no way to check it. We do, because the source is public. Go look, that URL above is real, search the codebase for it yourself, public data pulled in, nothing of yours pushed out, and no third party sitting in the middle of your traffic to make that happen.
Source: devowl.io’s guide to using Wordfence in a GDPR-compliant manner, confirming the Real-Time Wordfence Security Network requires visitor consent for the data it transfers.
