Licence & updates

Alovio Protect is free. There is no account, no licence key, and no server of ours the plugin depends on to do its job. You download it from alovio.org and activate it, and that is the whole of it.

How updates arrive

Because the plugin is distributed from alovio.org rather than the WordPress.org plugin directory, it asks our own server for its updates. New versions appear on Plugins → Updates like any other plugin, and the plugin row updates in place — there is no key to enter and nothing to activate. Under the hood the plugin advertises an update address (licenses.alovio.org/alovio-protect) that tells WordPress to take update news from there rather than from the plugin directory.

What the update check sends

About twice a day the plugin sends one request to our server carrying five things:

• the plugin slug,
• the version you are running,
• your site’s domain,
• the WordPress version, and
• the PHP version.

That request carries no personal data, no customer data, no content, and no licence key — because the plugin has none. We keep one record per site: the domain, the version, the WordPress and PHP versions, and when it was first and last seen. It exists so we know how many sites run the plugin and which versions are still in use — which is what tells us whether a release has reached people, and lets a decision to raise the WordPress or PHP a release needs rest on real sites rather than a guess. It is never sold, never shared, and never used to contact you.

If our server cannot be reached, nothing breaks: the check never reads as “you are up to date”, and it never disturbs the Plugins screen. It simply leaves the current state alone until the next check succeeds.

Turning the update check off

If you would rather the plugin tell us nothing, add this to wp-config.php:

define( 'ALOVIO_NO_UPDATE_CHECK', true );

The update check then stops entirely. It also stops the plugin being told about new versions, so you would watch alovio.org and install updates by hand. It does not affect the file integrity module, which makes its own requests to WordPress.org and is switched off in the plugin’s own settings. With both off, the plugin makes no outbound request at all.

Deactivating and uninstalling

• Deactivating removes the crash-guard drop-ins but deliberately keeps your data — the incident log, findings, login counters and restore points — so switching the plugin off for an afternoon does not throw any of it away.
• Uninstalling removes everything: the plugin’s options, the cached WordPress.org checksums, its scheduled events, and the whole wp-content/alovio-protect/ state folder. On a multisite network it cleans every site, and it removes the drop-ins only if they are still the ones it installed.

See also

• Getting started
• FAQ