Title: Apexly DSGVO-Check Author: pepelabs Published: August 16, 2026 Last modified: August 16, 2026 --- Search plugins ![](https://ps.w.org/apexly-dsgvo-check/assets/banner-772x250.png?rev=3649507) ![](https://ps.w.org/apexly-dsgvo-check/assets/icon-256x256.png?rev=3649507) # Apexly DSGVO-Check By [pepelabs](https://profiles.wordpress.org/pepelabs/) [Download](https://downloads.wordpress.org/plugin/apexly-dsgvo-check.0.2.2.zip) * [Details](https://wordpress.org/plugins/apexly-dsgvo-check/#description) * [Reviews](https://wordpress.org/plugins/apexly-dsgvo-check/#reviews) * [Installation](https://wordpress.org/plugins/apexly-dsgvo-check/#installation) * [Development](https://wordpress.org/plugins/apexly-dsgvo-check/#developers) [Support](https://wordpress.org/support/plugin/apexly-dsgvo-check/) ## Description Most privacy problems on a WordPress site are not created on purpose. A theme brings Google Fonts along, a plugin drops a tracking pixel, an embedded video pulls in a third-party server. None of it is visible: the site looks exactly the same in the browser. This plugin requests your own home page the way a first-time visitor receives it— with an empty cookie jar and no login — and then reports what actually happened. **It measures, it does not manage** The directory already has excellent consent plugins. They _set_ a banner. This plugin _measures_ what happens regardless of which banner is installed. That matters in practice: a misconfigured consent banner still loads trackers before consent is given, and the site owner has no way to notice. This plugin makes it visible, and therefore complements those plugins rather than replacing them. **What is checked** * **Cookies before consent** — which cookies are set before anyone agreed, and which service each belongs to * **Google Fonts** — whether fonts are loaded from Google’s servers * **Third-party hosts** — which external servers are contacted, and therefore see your visitors’ IP addresses * **Encryption** — whether the site runs over HTTPS * **Security headers** — Content-Security-Policy, Strict-Transport-Security, X- Content-Type-Options, Referrer-Policy * **Legal pages** — whether the imprint and privacy policy are linked from the home page, as German law (§ 5 DDG) requires * **WordPress version** — whether it is exposed in the page source * **Usernames** — whether account names can be enumerated through the REST API without logging in Every finding names the concrete evidence — which cookie, which host, which version— explains in one sentence what it means, and says what to do about it. **No data transfer** The plugin requests only the site it is installed on. It contacts no external server, at no point, for no purpose. There is no account, no API key, no licence check and no usage statistic. A search for `http://` or `https://` in the source code returns only the licence URL and the author’s website in the plugin header — no external address is ever requested. Results are stored in a single option in your own database and removed on uninstall. **No restrictions** Every finding is shown in full. You can run the check as often as you like. There is no locked feature, no counter, and no paid version required to see the result. **What the plugin cannot do** It checks when you open it. It cannot watch continuously — that would require something running all the time. If you would rather be notified automatically when something regresses, [Apexly](https://apexly.de/) does that. You do not need it for this plugin. **Language** The interface is in German because the plugin deals with German and EU legislation( TDDDG, DDG, GDPR) and the guidance references specific German provisions. Translations are welcome. **Not legal advice** The check describes technical findings, names the provisions involved — § 25 TDDDG for cookies, § 5 DDG for the imprint, Art. 32 GDPR for encryption — and suggests technical steps. That is general information, not legal advice. Whether and how a provision applies to a particular case can only be assessed by a lawyer, and the same is true for the question of whether implementing a step settles the matter. The plugin does not replace a review by a supervisory authority either. ### External services This plugin does not use any third party or external service. It sends no data anywhere. The plugin contains exactly one HTTP call (`wp_remote_get`, in `includes/class-apexds-pruefung.php`). It is used twice, both times against the site it is installed on: the home page (`home_url( '/' )`) and the site’s own REST route (`rest_url( 'wp/v2/users' )`). Both go to your own domain. There is no account, no API key, no licence check, no telemetry and no update server of our own. A note on the domain names in the source code: the file `includes/class-apexds-pruefung. php` contains a list of host names such as `fonts.googleapis.com`, `connect.facebook. net`, `js.stripe.com` and `cdnjs.cloudflare.com`. These are **search patterns, not requests**. The plugin scans the HTML of your own page for these strings in order to report “your site loads Google Fonts” or “your site embeds a Meta pixel”. Detecting an external service requires knowing its address; the plugin never contacts any of them. The same applies to the cookie name patterns in the same file. ## Screenshots [⌊The overview under Tools → DSGVO-Check: summary at the top, findings sorted by severity.⌉⌊The overview under Tools → DSGVO-Check: summary at the top, findings sorted by severity.⌉[ The overview under Tools DSGVO-Check: summary at the top, findings sorted by severity. [⌊A finding with its evidence and the note on how to fix it.⌉⌊A finding with its evidence and the note on how to fix it.⌉[ A finding with its evidence and the note on how to fix it. [⌊The progress display while the check is running.⌉⌊The progress display while the check is running.⌉[ The progress display while the check is running. ## Installation 1. Install and activate the plugin. 2. Go to **Tools DSGVO-Check** in the admin area. 3. Click **Jetzt prüfen**. The run takes a few seconds. ## FAQ ### Is any data sent to an external server? No. The plugin requests only your own website. There is not a single external address in the source code that gets requested. The lists of known services in the code are patterns used for comparison — they are never contacted. ### Do I need an account? No. There is no login and no key. The plugin works completely on its own. ### How often may I run the check? As often as you like. There is no limit. The check runs against your own server and costs nobody anything. ### Why do I get “Startseite konnte nicht abgerufen werden”? Some servers are not allowed to reach themselves through their public address. In that case the plugin honestly reports “not measurable” instead of “fine” — a display that reports unchecked items as passing would be worse than no display at all. ### Does the plugin fix the problems too? No, it shows them and explains how to fix them. Serving Google Fonts locally or setting security headers means changing the theme and the server configuration — no plugin should do that unasked. ### Why is my cookie banner plugin not listed? The result is measured, not the cause. If nothing is set before consent, the finding is fine — no matter which banner plugin is behind it. If something is set, the banner is either misconfigured or bypassed by another plugin. ### Does this replace a privacy policy? No. The plugin finds what happens technically on your site. What belongs in the privacy policy and how it must be worded is a legal question. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Apexly DSGVO-Check” is open source software. The following people have contributed to this plugin. Contributors * [ pepelabs ](https://profiles.wordpress.org/pepelabs/) [Translate “Apexly DSGVO-Check” into your language.](https://translate.wordpress.org/projects/wp-plugins/apexly-dsgvo-check) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/apexly-dsgvo-check/), check out the [SVN repository](https://plugins.svn.wordpress.org/apexly-dsgvo-check/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/apexly-dsgvo-check/) by [RSS](https://plugins.trac.wordpress.org/log/apexly-dsgvo-check/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.2.2 * Re-submitted the corrected package through the plugin submission page. No change to the code, the readme or the behaviour compared with 0.2.1. #### 0.2.1 * Corrected the “External services” section: it previously mentioned a third HTTP request that the code does not make. The plugin makes exactly two, both to the site it is installed on. #### 0.2.0 * All declarations, options, transients, AJAX actions, script handles and CSS classes now use the prefix `apexds` instead of the three-character `dwc`. * Added an “External services” section stating that the plugin uses none, and explaining why host names appear in the source. #### 0.1.0 * First release: 11 checks, findings with evidence and remediation notes, progress display during the run. ## Meta * Version **0.2.2** * Last updated **10 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0.4** * PHP version ** 7.4 or higher ** * Tags * [cookies](https://wordpress.org/plugins/tags/cookies/)[GDPR](https://wordpress.org/plugins/tags/gdpr/) [imprint](https://wordpress.org/plugins/tags/imprint/)[privacy](https://wordpress.org/plugins/tags/privacy/) [Security Headers](https://wordpress.org/plugins/tags/security-headers/) * [Advanced View](https://wordpress.org/plugins/apexly-dsgvo-check/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/apexly-dsgvo-check/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/apexly-dsgvo-check/reviews/) ## Contributors * [ pepelabs ](https://profiles.wordpress.org/pepelabs/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/apexly-dsgvo-check/)