DigitalSpace Personal Data Scanner

Most WordPress sites hold far more personal data than their owners know: old form submissions, comment emails and IP addresses, IBANs pasted into order notes, drafts nobody deleted, options a plugin filled years ago. Personal Data Scanner finds it, tells you where it is, and links you straight to the record so you can act.

Run one scan and you have a personal data inventory: how many items, of which kinds, in which places.

Docs, FAQ and Pro: personaldatascanner.com

Built to support the data-mapping step behind GDPR, HIPAA and CCPA work: you cannot protect, minimise or delete personal data (PII) until you know where it is. The scanner shows you where it sits. It does not make a site compliant on its own, and it is not legal advice.

What it scans (free)

• Users and user meta (including WooCommerce billing and shipping fields)
• Comments and comment meta, including spam, trash and WooCommerce order notes
• Posts, pages, custom post types, revisions, drafts and post meta
• WooCommerce orders and customers (HPOS and legacy storage)
• WooCommerce coupon email restrictions
• WooCommerce downloadable-product permissions and the download log (IP addresses)
• Contact Form 7 submissions stored by Flamingo
• WPForms entries (WPForms Pro stores entries; Lite does not)
• Gravity Forms entries
• The options table, including serialized and JSON values

What it detects

• Email addresses
• Phone numbers (international and common national formats)
• IP addresses (v4 and v6)
• IBANs, validated with the ISO 13616 checksum
• Payment card numbers, validated with the Luhn check and issuer ranges
• National ID numbers: German Steuer-ID, UK National Insurance number, US SSN, Georgian personal number, Italian codice fiscale, Spanish DNI/NIE, Dutch BSN
• VAT / tax ID numbers: Germany, France, Italy, each checked with its own real checksum
• Dates of birth in labelled fields or next to a birth keyword
• Names in labelled fields (first name, last name, billing name, comment author)
• Addresses in labelled fields (address, billing/shipping address, street, and common non-English equivalents)
• API keys and secrets: AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, JWTs, and PEM/SSH private keys
• Health keywords and ICD-10 codes for the special-category angle (off by default)

Every finding carries a confidence score so you can focus on the sure things first.

Privacy by design

• The plugin stores masked values only, for example j***@example.com or DE89**************3000. It never becomes a second copy of your personal data.
• Nothing leaves your server. The scan runs entirely inside your WordPress install and the plugin makes no outbound requests. There is no telemetry.
• Every action requires the manage_options capability and a nonce.

Working with findings

• Filter by source, type, confidence and status; search labels and masked values
• Open the record in its own edit screen with one click
• Bulk Ignore, which stays in effect for future scans until you reopen it
• Printable on-screen report with a source-by-type matrix and the records holding the most personal data
• WP-CLI: wp pdscan scan, wp pdscan status, wp pdscan findings, wp pdscan info

Pro

Delete and anonymize findings (WooCommerce-aware), retention rules, scheduled scans with email summaries, data subject request lookup by email address, custom detectors and custom sources, CSV export. Pro buttons are visible in the free version; clicking one links to the Pro pricing page.

Developers

• Add a data source: implement PDScan\Scan\SourceInterface and hook pdscan/sources
• Add a detector: implement PDScan\Scan\DetectorInterface and hook pdscan/detectors
• Add a national ID format in src/Scan/Detectors/national-ids.php or via pdscan/national_ids
• Add a secret/API key format in src/Scan/Detectors/secret-keys.php or via pdscan/secret_keys
• Add a VAT/tax ID format in src/Scan/Detectors/vat-ids.php or via pdscan/vat_ids
• Filters: pdscan/is_pro, pdscan/batch_findings, pdscan/keep_scans, pdscan/health_keywords, pdscan/woocommerce/hpos, pdscan/posts/skip_types, pdscan/options/skip_names
• The admin screens are a React app. Source is in assets/src/, shipped alongside the built assets/build/index.js it compiles to. Rebuild with npm install then npm run build (uses webpack.config.js and @wordpress/scripts); nothing outside WordPress core’s own bundled @wordpress/* packages is used.