Skip to main content

​
What is sent

For each public front-end request: timestamp, host, path, HTTP method, status code, response size, visitor IP address, user agent, referrer (scheme, host and path only) and the query string with sensitive keys removed. Requests go to https://ingest.rankraft.ai about once a minute. That address is fixed and can’t be changed.

​
What is never sent

  • Cookies, form data, page content or anything about logged-in users.
  • Anything from the admin area, logged-in dashboards, REST calls, AJAX, cron or WP-CLI.
  • These paths, which are always excluded and can’t be re-enabled: wp-admin/*, wp-login.php, wp-cron.php, wp-json/*, admin-ajax.php, xmlrpc.php, /checkout*, /cart*, /my-account*.
Add your own patterns under Privacy → Also never log these paths.

​
Query string redaction

Query parameters whose names contain any of the following are replaced with [REDACTED] before anything leaves your server: password, pass, pwd, token, auth, key, secret, card, cc, ssn, email, otp, code, nonce, session The list is fixed and can’t be switched off. Developers can add more names with the rankraft_aa_redact_keys filter.

​
How RankRaft AI stores it

IP addresses are used to verify crawlers against providers’ published ranges, then stored only as a salted hash that rotates daily. Raw user agents, query strings and referrers aren’t stored. Human visits are counted, not logged. See the privacy policy.

​
Trusted proxies

The plugin needs the visitor’s real IP address to verify crawlers. It decides which address to trust like this:
  • Behind Cloudflare: if the connection comes from Cloudflare’s published ranges, it uses CF-Connecting-IP. No setup needed.
  • Behind a local or private proxy: it uses True-Client-IP, then X-Real-IP, then the last X-Forwarded-For hop.
  • Otherwise: it uses the connecting address and ignores forwarding headers, so they can’t be forged.
If your site sits behind another CDN or load balancer with public IP addresses, add them with a filter. Otherwise genuine crawlers will show as Spoofed:

​
Site key storage

The key is encrypted with libsodium using your WordPress salts (AUTH_KEY and SECURE_AUTH_KEY). If the Sodium extension is missing, it is stored as typed and the plugin shows a notice. Defining RANKRAFT_SITE_KEY in wp-config.php keeps the key out of the database entirely.

​
WordPress privacy policy

The plugin offers suggested policy text under Settings → Privacy → Policy Guide.