Security

What we do to protect your account and your website connection:

• Your WordPress application password is encrypted at rest and never shown again after it is saved.
• Passwords are stored as one-way hashes. Login attempts are rate-limited and repeated failures lock the account for a while.
• You can see and sign out your other devices. Changing your password signs out every device.
• Every request to your data is checked against your account. Other customers cannot read your articles or sites.
• Addresses we fetch on your behalf are checked so they cannot reach private networks.
• Security-relevant actions (logins, password and email changes, deletions) are written to an audit log.
• You can download your data or delete your account yourself from Settings.

Found a vulnerability? Please email us through the Contact page and give us a reasonable time to fix it before sharing details.