WEDOS | Protection & Cache Performance

The plugin connects your website to WEDOS Global Protection and keeps an eye on its health. Setup is guided step by step and suits non-technical site owners: the plugin prefills your domain, shows exactly the DNS records WEDOS Protection asks for and nothing is registered until you confirm it.

Protection

• Cloud WAF and DDoS protection: harmful traffic is filtered on the WEDOS network before it reaches your server.
• Free setup or your existing service: a domain without protection gets a free WEDOS Protection service after your consent. A domain that is already protected (also in your own WEDOS account) is only displayed, never registered again.
• Dashboard: protection status, the DNS records to set and traffic analytics.

Speed

• WP-CDN: WordPress core, WooCommerce, plugin and theme files served from the WEDOS CDN. A file is rewritten only when its SHA-256 hash matches the CDN copy. Off until you enable it.
• Page Local Cache: rendered pages stored as static HTML on your server.

Security checks

• Vulnerabilities: installed plugins, themes and WordPress core compared daily with a database of publicly known vulnerabilities. The comparison runs on your server.
• Recommendations: concrete fixes based on your own traffic, applied only after you confirm them.
• UpdraftCentral key compromise: detection of the October 2026 backdoor, with the steps to take. Read-only: the plugin never changes other plugins or accounts.

Links

• WEDOS Global
• Knowledge Base
• Community Help

The service is provided by WEDOS Group SA, 7 Rue Robert Stumper, L-2557 Luxembourg, EU: Terms of Service, Privacy Policy.

External services

No personal data of your visitors is ever transmitted.

WEDOS Global Protection (plugin.wedos.global)

• Used to verify domain ownership (a verification file the plugin writes to /.well-known/), to register the protection service and to read its status and traffic statistics.
• Data sent: domain name, server IP address, admin email address, a request ID and this installation’s private API key (it proves the request comes from this site; only its SHA-256 hash is published in the verification file).
• A protection service is registered only after you click “Activate protection + CDN” and confirm the consent dialog.

WEDOS CDN (wp-cdn.wedos.com)

• Only when WP-CDN is enabled: serves static files of WordPress core, WooCommerce, plugins and themes, and the manifest with their SHA-256 hashes.
• No data about visitors is transmitted.

Anonymous telemetry (plugin.wedos.global)

• Only when you opt in: plugin version, WordPress version and number of rewritten files, once a day. No domain, IP address or personal data.

Subscriptions (plugin.wedos.global) and billing (FastSpring)

• Used only when you start a trial or buy a paid plan. Data sent: domain name, admin email address, plan.
• Orders are processed by FastSpring (fastspring.com) as the merchant of record; see FastSpring’s privacy policy.
• The free plan works without any subscription. When a trial ends, the plugin keeps working on the free plan.

Vulnerability database (utils.wedos.tools)

• Downloaded once a day (compiled from the Wordfence Intelligence feed, CC BY-ND 4.0). Nothing about your site is sent.

Website performance check (utils.wedos.tools)

• Once a day measures the public loading speed of your website for the Site Snapshot card. Data sent: domain name.

Recommendations (plugin.wedos.global)

• The signed list of recommendations is downloaded hourly; nothing about your site is sent.
• When you confirm, ignore or undo a recommendation on a site protected by WEDOS, the plugin reports the domain, the recommendation ID, your decision and the number and average duration of matching requests in the last 24 hours.

Bundled libraries

All code ships inside the plugin package:

• Chart.js 4.4.0 (MIT): dashboard charts. File assets/vendor/wedos-chart.umd.min.js, an unmodified copy of chart.umd.min.js. Source: https://github.com/chartjs/Chart.js/releases/tag/v4.4.0
• jsVectorMap 1.7.0 (MIT, license in assets/vendor/jsvectormap/): the visitor map (paid feature). Source: https://github.com/themustafaomar/jsvectormap
• WEDOS vulnerability matcher (includes/Vuln/): our own unminified GPL code.

Optionally, the dashboard can load Chart.js and jsVectorMap from wp-cdn.wedos.com instead (switch “Dashboard libraries”). It is off by default; every CDN file carries a Subresource Integrity hash and falls back to the bundled copy.