Yes. WordPress.org plugin guideline 7 says plugins may not contact external servers without explicit, opt-in consent, and data collection and use must be documented in the readme. Undocumented blocklists and third party ad tracking are prohibited. Related guidelines limit where code may load from and how updates may arrive.
What the guidelines say
From the directory's detailed plugin guidelines:
- Guideline 6: plugins may act as interfaces to third party services, even paid ones. The service must offer substantial functionality and be documented in the readme, ideally with a link to its terms of use. License validation only services and storefronts are not allowed.
- Guideline 7: no contacting external servers without explicit opt-in consent. Data collection and use must be documented in the readme. Undocumented blocklists and third party ad tracking are prohibited.
- Guideline 8: external code may only be loaded from documented services. Plugins may not serve updates or install add-ons from non-WordPress.org servers. Third party CDNs are limited to font inclusion, and other JavaScript and CSS must be local.
- Guideline 4: obfuscation is prohibited, and source code and build tools must be publicly accessible.
There is a separate post on why plugins must not update from elsewhere.
Why opt-in matters for site owners
A plugin that phones home by default tells a third party that your site exists, which version it runs, and often more. For a business that has data protection duties, that is a disclosure you did not decide on. Opt-in puts the decision with the site owner.
What to check before installing
| Check | Where to look |
|---|---|
| Does it contact outside services? | Readme section on external services |
| Is consent requested first? | Plugin setup screen after activation |
| What data is sent? | Readme and linked privacy policy |
| Is there a link to terms of use? | Readme |
| Do assets load from third party hosts? | Page source and network panel on a staging site |
A ten minute staging test
- Install the plugin on a staging site with no real data.
- Open the browser network panel and the server's outbound logs if you have them.
- Activate the plugin and do nothing else. Note any outside requests.
- Walk through setup and see when consent is asked.
- Compare observed requests with the readme.
If requests go out before any consent, or to hosts the readme does not mention, take that to the author and consider an alternative.
For plugin authors
- Ship with outside communication off.
- Ask in plain words, with the destination named.
- Document each external service and what is sent.
- Keep third party code out of the page unless it is a documented service.
- Provide a way to turn it off again.
These steps also make your plugin easier to approve and easier for a security review to pass.
What happens when a plugin breaks the rules
The guidelines say violations may lead to removal of plugins or plugin data until issues are resolved, repeat violations may lead to removal of all of an author's plugins and a ban, and the directory may disable or remove any plugin, even for reasons not listed. Guideline 18 also lets the directory make changes without developer consent in the interest of public safety.
Safeguard's SBOM and dependency scanning can inventory the plugins and libraries on a managed site's codebase, and its compliance and evidence automation can hold your approval records.
Quick check
Does guideline 7 ban all external services?
No. Plugins can use third party services if documented and the user gives opt-in consent.
Can a plugin load JavaScript from a public CDN?
Guideline 8 limits third party CDNs to font inclusion. Other JavaScript and CSS must be local.
Where should data use be documented?
In the plugin's readme, according to guideline 7.
Sources
Last reviewed: 19 October 2026.
