Signed WordPress plugin updates and a plugin you can verify
Silent Threads uses signed WordPress plugin updates: every update package, license and cloud feed is signed with Ed25519, and the plugin refuses anything whose signature doesn’t verify. It also checks its own files against a signed manifest, uses HTTPS-only signed requests, and never sends your posts, files or passwords.
How signed WordPress plugin updates work here
Signed updates, licenses and feeds
Updates, licenses and live feeds are Ed25519-signed, and the plugin verifies every signature before using them.
A plugin that checks itself
The plugin verifies its own files against a signed manifest and stops if they have been modified.
HTTPS only, every request signed
All traffic to our servers is HTTPS-only, and every request from your site is individually signed.
Your content stays yours
The plugin never sends your posts, files or passwords. The only visitor data it sends is the IP address of requests it identified as attacks.
What the plugin sends
- License checks (about every 12 hours)
- Update checks
- Signed requests for the live signature, WAF rule and blocklist feeds
- Attacker IP addresses, for a country lookup on the plugin's attack map. They are looked up in memory and not stored.
- Only if you turn on “Help protect other sites”: the IPs your site already blocked and the rule IDs that blocked them
What it never sends
- Your posts or pages
- Your files
- Passwords
- Visitor data, apart from the IP addresses of requests it identified as attacks
Network protection, with guard rails
The network IP blocklist is built so that it can't be used against you.
- Network IP Blocklist (Pro and Agency): an IP is listed only after several different sites have reported it. Search engines and CDNs are never listed.
- Your own login IPs, your trusted IPs and logged-in administrators are never blocked by the network list.
- “Help protect other sites” is opt-in and off by default. It shares only IPs your site already blocked, plus the rule IDs that blocked them.
- Entries expire automatically. Raw reports are deleted after 30 days.
The threat map on our home page
The globe uses the same opt-in reports, reduced so that no site or visitor can be identified.
- Country level only. IP addresses are turned into a country on our server and never published.
- The last 24 hours, delayed by at least 15 minutes, refreshed every 5 minutes.
- A country appears only with at least 5 events reported by at least 2 different sites.
- While fewer than 5 sites share data, the globe shows a labelled illustration with no numbers.
- Test sites are excluded.
Failing safely
If a license check really fails (the license expired, was suspended or a payment did not go through), the plugin says so in WordPress admin rather than carrying on in a silently degraded state.
If our servers are just unreachable, the plugin keeps running on its last known-good license state for a short offline grace window, so a brief network problem doesn't turn your firewall off.
Found a security issue?
Please tell us privately through the contact form and include the steps to reproduce it. We'll reply by email.