Renamed to Kipphard GDPR Web Fonts; full-site scanning for everyone; unique prefixes.<\/p>","0.3.0":"
Shared admin design system for a consistent look. No functional changes.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3602679,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3602679,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3602679,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.4.3","0.4.4","0.4.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3602679,"resolution":"1","location":"assets","locale":"","width":1500,"height":930},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3602679,"resolution":"2","location":"assets","locale":"","width":1500,"height":930}},"screenshots":{"1":"The dashboard: overall risk badge, detected external services grouped by risk level, with example URLs and recommendations.","2":"The settings page: quick-fix toggles (remove Google Fonts, disable WordPress emojis, replace Gravatar locally)."}},"plugin_section":[],"plugin_tags":[154545,131785,3778,396,5127],"plugin_category":[54],"plugin_contributors":[270348],"plugin_business_model":[],"class_list":["post-337167","plugin","type-plugin","status-publish","hentry","plugin_tags-dsgvo","plugin_tags-gdpr","plugin_tags-google-fonts","plugin_tags-privacy","plugin_tags-webfonts","plugin_category-security-and-spam-protection","plugin_contributors-kipphard","plugin_committers-kipphard"],"banners":{"banner":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/banner-772x250.png?rev=3602679","banner_2x":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/banner-1544x500.png?rev=3602679","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/icon-256x256.png?rev=3602679","icon_2x":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/icon-256x256.png?rev=3602679","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/screenshot-1.png?rev=3602679","caption":"The dashboard: overall risk badge, detected external services grouped by risk level, with example URLs and recommendations."},{"src":"https:\/\/ps.w.org\/kipphard-gdpr-webfonts\/assets\/screenshot-2.png?rev=3602679","caption":"The settings page: quick-fix toggles (remove Google Fonts, disable WordPress emojis, replace Gravatar locally)."}],"raw_content":"\n
Kipphard GDPR Web Fonts<\/strong> is an honest audit tool for WordPress sites. It fetches the HTML your site actually delivers and detects external requests that transmit personal data \u2014 such as IP addresses \u2014 to third-party servers, including Google Fonts, Google Analytics, YouTube embeds, Google Maps, Gravatar, reCAPTCHA, Facebook Pixel, Hotjar, and common JavaScript CDNs.<\/p>\n\n The plugin groups findings by risk level with clear, actionable recommendations. Several common issues can be fixed directly through the plugin settings without touching code.<\/p>\n\n What this plugin does:<\/strong><\/p>\n\n What this plugin does NOT do:<\/strong><\/p>\n\n This plugin is not a cookie-banner overlay<\/em> and does not<\/em> claim automatic GDPR compliance. The scan is static: requests triggered dynamically by JavaScript after page load may not appear in the delivered HTML and will therefore not be detected. A complete privacy audit additionally requires browser developer tools or a specialised service.<\/p>\n\n This plugin does not replace legal advice. Use it to identify and reduce external requests; have a lawyer or data-protection officer review your specific situation.<\/p>\n\n About the Google Fonts ruling:<\/strong> On 20 January 2022 the Munich Regional Court I (LG M\u00fcnchen I, Az. 3 O 17493\/20) ruled that embedding Google Fonts without visitor consent violates the GDPR because the visitor's IP address is transmitted to Google servers in the USA. This plugin helps you detect and remove such requests.<\/p>\n\n Hinweis (DE): Dieses Plugin ist ein ehrliches Datenschutz-Analyse-Werkzeug f\u00fcr WordPress-Seiten. Es scannt das gerenderte HTML auf externe Anfragen (Google Fonts, Analytics, YouTube, Gravatar u. v. m.), die personenbezogene Daten an Dritte \u00fcbertragen, und bietet direkte Schnell-Ma\u00dfnahmen. Die Benutzeroberfl\u00e4che ist auf Deutsch verf\u00fcgbar.<\/em><\/p>\n\n This plugin does not<\/strong> connect to any third-party or external service, and it sends no data off your server.<\/p>\n\n To analyse your site it fetches your own published URLs over HTTP \u2014 restricted to your own host by an SSRF safeguard \u2014 and parses the returned HTML locally on your server. The service domains referenced in the plugin code (Google Fonts, Google Analytics, Facebook, jQuery\/CDN hosts, Font Awesome, etc.) are detection signatures<\/strong> the scanner searches for<\/em> inside your own HTML; the plugin never loads, embeds or contacts them.<\/p>\n\n\n No. This is an audit tool, not a compliance overlay. It shows you which external requests your site makes and provides recommendations, but the actual work \u2014 hosting fonts locally, obtaining consent, replacing services \u2014 has to be done by you or your development team. When in doubt, consult a data-protection professional or lawyer.<\/p><\/dd>\n All of them: the scan covers your homepage plus every published page and post. Very large sites are capped at 200 URLs per run \u2014 a performance safeguard, not a feature limit.<\/p><\/dd>\n No. The plugin fetches your own URLs internally over HTTP and analyses the returned HTML locally. No data is transferred to any third party.<\/p><\/dd>\n The plugin analyses the HTML that your server delivers on initial load. Requests triggered later by JavaScript (for example on scroll or click) are not visible in the static HTML and are therefore not detected. For a complete picture, also check your browser's Network tab.<\/p><\/dd>\n Removing a font reference that a theme has hard-coded into its templates, or written as an On WordPress 6.4 to 6.8 the quick fix still removes Google Fonts stylesheets that were enqueued through WordPress (the common case) and the On 20 January 2022 the Munich Regional Court I (LG M\u00fcnchen I, Az. 3 O 17493\/20) ruled that embedding Google Fonts without visitor consent violates the GDPR, because the visitor's IP address is transmitted to Google servers in the USA without a legal basis. This plugin flags that risk and lets you remove the external requests entirely.<\/p><\/dd>\n Make sure your site is reachable from itself \u2014 no \"coming soon\" mode, no HTTP authentication. The plugin fetches your own URLs internally over HTTP. Also verify that the PHP \n
<link><\/code> tags and @import<\/code> rules \u2014 see the FAQ for the WordPress 6.9 requirement), disable WordPress emoji scripts (removes the s.w.org<\/code> request), replace Gravatar with a local SVG placeholder<\/li>\nExternal services<\/h3>\n\n
\n
kipphard-gdpr-webfonts<\/code> folder to \/wp-content\/plugins\/<\/code>, or install it from the Plugins screen in your WordPress admin.<\/li>\n\n
Does this plugin make my site automatically GDPR-compliant?<\/h3><\/dt>\n
How many pages are scanned?<\/h3><\/dt>\n
Is any data sent to external servers during a scan?<\/h3><\/dt>\n
Why does the scan not detect all external requests?<\/h3><\/dt>\n
Why does removing Google Fonts need WordPress 6.9?<\/h3><\/dt>\n
@import<\/code> rule inside a <style><\/code> block, means rewriting the finished HTML page. WordPress 6.9 introduced a standard way for plugins to do that \u2014 the template enhancement output buffer \u2014 and this plugin uses it rather than opening an output buffer of its own, which is unreliable when several plugins do it at once.<\/p>\n\npreconnect<\/code> \/ dns-prefetch<\/code> hints. Hard-coded <link><\/code> tags and @import<\/code> rules are left in place; the scan report continues to list them so you can remove them from your theme by hand.<\/p><\/dd>\nWhy is Google Fonts classified as \"High risk\"?<\/h3><\/dt>\n
The scan fails or returns no results. What can I do?<\/h3><\/dt>\n
dom<\/code> and libxml<\/code> extensions are available on your server.<\/p><\/dd>\n\n<\/dl>\n\n\n0.4.5<\/h4>\n\n
\n
0.4.4<\/h4>\n\n
\n
0.4.3<\/h4>\n\n
\n
0.4.2<\/h4>\n\n
\n
0.4.1<\/h4>\n\n
\n
0.4.0<\/h4>\n\n
\n
0.3.0<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n