External services Nahnu Login Shield can contact

Nahnu Login Shield works fully offline by default. It contacts another service only when you choose or set up a feature that needs one. It never sends data to a Nahnu server, and it has no telemetry, tracking or update-check calls of its own.

This topic lists each service, when it’s contacted, and what it receives. Use it for your privacy policy and your cookie consent setup.

How to read this topic#

Services are contacted in one of two ways:

• By the visitor’s browser. The visitor’s browser loads a script or makes a request itself. The service sees the visitor’s IP address and browser details directly.
• By your server. Your site’s server makes the request. The service sees your server’s address and whatever the plugin sends it.

At a glance#

Service	Feature	Contacted by	Only when
Google reCAPTCHA	CAPTCHA provider	Browser and server	You pick reCAPTCHA v2 or v3
hCaptcha	CAPTCHA provider	Browser and server	You pick hCaptcha
Cloudflare Turnstile	CAPTCHA provider	Browser and server	You pick Turnstile (managed or invisible)
Friendly Captcha	CAPTCHA provider	Browser and server	You pick Friendly Captcha
OOPSpam	CAPTCHA provider	Server (through the OOPSpam Anti-Spam plugin)	You pick OOPSpam
freeipapi.com	Country lookup	Server	Geo-blocking is on, you pick freeipapi, and no CDN country header is present
ipinfo.io	Country lookup	Server	Geo-blocking is on, you pick ipinfo, and no CDN country header is present
Bunny.net API	Edge blocking	Server	You turn on Bunny edge blocking
Cloudflare API	Edge blocking	Server	You turn on Cloudflare edge blocking
Your mail service	Emails the plugin sends	Server	You use 2FA email codes, magic links, signup verification, alerts or the digest

If you use none of these features, the plugin makes no outside requests.

CAPTCHA providers#

Only the provider you select on the Widget tab is used. With None selected, no CAPTCHA service is contacted.

Google reCAPTCHA (v2 and v3)

• Browser: loads the reCAPTCHA script from google.com/recaptcha on pages with a protected form. Google receives the visitor’s IP address and browser information, and may set its own cookies.
• Server: on each submit, the plugin sends the visitor’s response token and your reCAPTCHA secret key to https://www.google.com/recaptcha/api/siteverify.
• Terms: https://policies.google.com/terms · Privacy: https://policies.google.com/privacy

hCaptcha

• Browser: loads the script from js.hcaptcha.com. hCaptcha receives the visitor’s IP address and browser data.
• Server: sends the response token and your secret key to https://api.hcaptcha.com/siteverify.
• Terms: https://www.hcaptcha.com/terms · Privacy: https://www.hcaptcha.com/privacy

Cloudflare Turnstile

• Browser: loads the script from challenges.cloudflare.com. Cloudflare receives the visitor’s IP address and browser data.
• Server: sends the token and your secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify.
• Terms: https://www.cloudflare.com/website-terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

Friendly Captcha

• Plugin: the widget script is bundled with the plugin, so nothing is loaded from a CDN.
• Browser: fetches a puzzle from api.friendlycaptcha.com while the form is showing. Friendly Captcha receives the visitor’s IP address.
• Server: sends the solved puzzle, your site key and your API key to https://global.frcapi.com/api/v2/captcha/siteverify.
• Terms: https://friendlycaptcha.com/legal/terms/ · Privacy: https://friendlycaptcha.com/legal/privacy-end-users/

OOPSpam

OOPSpam needs the separate OOPSpam Anti-Spam plugin and its API key. Nahnu Login Shield asks that plugin to check the submission. The OOPSpam plugin sends the visitor’s IP address and the submitted username or email address, along with your API key, to OOPSpam to get a spam, VPN and data-centre score.

• Terms: https://www.oopspam.com/terms · Privacy: https://www.oopspam.com/privacy

If a provider can’t be reached, the check may let the visitor through or block them, depending on the provider and the kind of problem. See What happens if a provider goes down.

{Screenshots: the Widget tab with a provider selected; a browser’s network panel showing the provider’s script request (optional)}

Country lookups#

Geo-blocking reads the country from your CDN’s headers first. Those headers are free and instant, and no outside service is involved. Only when there is no header does the plugin ask a lookup service, and only the one you chose on the Geo tab.

freeipapi.com

Your server sends the visitor’s IP address (and your optional API key) to https://free.freeipapi.com/api/json/{ip} and gets back a country code. The answer is cached on your site per IP.

• Terms: https://freeipapi.com/terms · Privacy: https://freeipapi.com/privacy

ipinfo.io

Your server sends the visitor’s IP address (and your optional token) to https://api.ipinfo.io/lite/{ip} and gets back a country code. The answer is cached on your site per IP.

• Terms: https://ipinfo.io/terms-of-service · Privacy: https://ipinfo.io/privacy-policy

See Geo-blocking without a CDN.

Edge blocking#

Bunny.net

When a lockout or honeypot event fires and Bunny edge blocking is on, your server sends the blocked IP address, an expiry time and a short note to Bunny’s firewall for your pull zone, authenticated with your Bunny API key. The Test connection button reads your pull zone details with the same key.

• Terms: https://bunny.net/tos/ · Privacy: https://bunny.net/privacy

Cloudflare

When a lockout or honeypot event fires and Cloudflare edge blocking is on, your server creates an IP access rule in your Cloudflare account containing the blocked IP address and a note, authenticated with your API token. A scheduled task later deletes the rule when the block ends. The Test connection button checks the token.

• Terms: https://www.cloudflare.com/website-terms/ · Privacy: https://www.cloudflare.com/privacypolicy/

See Block at the edge with Bunny.net and Block at the edge with Cloudflare.

Email#

Nahnu Login Shield sends email through WordPress’s own mail function. That means your site’s mail setup (your host, or an SMTP or email service plugin) handles the messages and sees them. This covers two-factor codes, magic links, signup confirmations, login alerts and the weekly digest. The plugin does not use an email service of its own.

Things that are not external#

• Country flags in the Log tab are image files bundled with the plugin. No flag service is called.
• Charts on the Analytics tab use a bundled library. Nothing loads from a CDN.
• Passkeys are handled by the visitor’s browser and device. The plugin does not contact a passkey service.
• The About and More plugins tabs only show links to other Nahnu products. Nothing is sent when you view them, only when you click a link.
• MainWP. A MainWP extension will be published later. It will get its own documentation.

For your privacy policy and cookie notice#

• List the CAPTCHA provider you use, the geo lookup service (if any), and the edge blocking service (if any), with a link to each one’s privacy policy.
• CAPTCHA providers can set their own cookies or collect browser data. If you run a cookie consent tool, check how it treats the provider’s script. Blocking the script until consent is given will stop the CAPTCHA from working before consent, so many sites classify it as necessary for security.
• Nahnu Login Shield itself sets one small cookie, described in What data Nahnu Login Shield stores.
• If your visitors are in a region with data protection rules, ask a qualified adviser what your notice must say. This topic describes what the plugin does, not what the law requires.