Settings

Data retention and removal

Every planAbout Dashboard and Security Score

How long Stack Guard keeps each kind of record, when it tidies up, and exactly what is removed if you delete the plugin.

What it does

The Retention overview lists every kind of record, how long it is kept and when the next clean-up runs: the activity log, sign-in attempts, the 404 log, malware scan history, records of deleted files and expired bans.

Login attempt records sets how long failed sign-in records are kept.

The Danger zone explains what happens when the plugin is removed.

Why it matters

Security records include internet addresses, which privacy law treats as personal data. Keeping them only as long as needed is both good practice and often a legal duty.

Set it up

Go to the Settings tab, section Data and retention.
Choose Keep records for, from 1 to 90 days, and click Save Changes.
Use the links in the overview to change the activity log and 404 log windows on their own tabs.

Deactivating or deleting the plugin

Deactivating keeps everything, so you can switch Stack Guard back on later exactly as it was.

Deleting does what you chose under When Stack Guard is deleted in the Danger zone of the Settings tab. Keep settings is the default: every setting, each user's two-factor setup, the ban list, firewall rules, the file fingerprints, ignored and quarantined scan findings, the backup list and the country database stay, so reinstalling picks up where it left off. The activity log, sign-in attempts, 404 log, past scans, temporary data and scheduled tasks are removed.

The license key is removed either way. After reinstalling, enter it again on the License tab and the Pro settings come back as they were; they are kept while the site runs on Free.

Remove everything also removes the settings, every Stack Guard table, each user's two-factor setup, the country database and the quarantine folder. Finished backups stay on the server, and backups of wp-config.php in wp-content/stack-guard-backups/ are kept. Export your settings first if you might return.

To start over after a reinstall that kept settings, use Reset all settings on the Settings tab.

Which plan includes it

Retention settings are in every plan. On Free the activity log keeps 7 days.

How it works, for developers

Login attempts are kept for smg_login_attempts_retention hours (default 168, range 1 to 8760), but never shorter than an active lockout needs (the lockout or check window plus 24 hours).
Clean-up tasks: smg_daily_cleanup (attempts, expired bans, deleted-file records, scan history), smg_activity_cleanup, smg_cleanup_404_logs.
The choice is the option smg_uninstall_data: keep (default, also when unset) or remove. On a network each site follows its own choice.
Keep settings drops smg_login_attempts, smg_activity_log, smg_404_log, smg_magic_links and smg_malware_scans, deletes smg_malware_issues rows other than ignored and quarantined ones, and removes every smg_ transient except backup ones (smg_bk_; running and waiting backup or restore jobs are left as they are), smg_license_*, smg_csp_violations, smg_db_version (so the first request after a reinstall creates the dropped tables again) and every smg_ scheduled task.
Remove everything deletes every smg_ option and transient, all Stack Guard tables, smg_ scheduled tasks, uploads/stack-guard/geo, and, once no site of a network kept its settings, smg_ user meta and wp-content/stack-guard-quarantine.

Quick answers about data retention and removal

What does Data retention and removal do in Stack Guard?

The Retention overview lists every kind of record, how long it is kept and when the next clean-up runs: the activity log, sign-in attempts, the 404 log, malware scan history, records of deleted files and expired bans. Login attempt records sets how long failed sign-in records are kept. The Danger zone explains what happens when the plugin is removed.

Why use data retention and removal on a WordPress site?