This page says what the free plugin sends outside your site, what it keeps on your site, and how to avoid either. It was checked against the plugin’s code. The same text is in the plugin’s readme on WordPress.org.
Short version: nothing is sent to us. The plugin has one outside lookup, and only in one situation.
The one outside lookup: server IP blacklists
The “Server IP Blacklists” check asks two public blacklists whether your web server’s IP address is listed. A blacklist is a shared list of addresses that are known for sending spam. If your server is on one, mail sent from it is likely to be rejected or sent to spam.
What is sent. A DNS query (a lookup, like the one your browser does to find a website) for your web server’s public IPv4 address, written backwards, for example 4.3.2.1.dnsbl.dronebl.org. The operators of the lists can see that address and the address of your DNS resolver (the server that answers lookups for your host). No other data is sent: no email addresses, no message content, no site URL, no personal data.
When. Only when your site does not send email through an SMTP plugin or mail service, and only when you open the plugin’s Health Report or Tools > Site Health. It does not run on your visitors’ page views.
Who sees the result. Only people who can open the report or Site Health in wp-admin. The result is not sent anywhere.
How the lookup goes out. Through your server’s own DNS resolver. The plugin does not call any web service and holds no API key.
Caching. The answer is saved for about 12 hours. After a failed lookup it is saved for about 1 hour, so the plugin tries again sooner. A new lookup also happens when you press the Re-check button or when your server’s IP address changes.
The lists
| List | Operator information |
|---|---|
| DroneBL | dronebl.org, DroneBL terms of use |
| PSBL | psbl.org, queried at psbl.surriel.com; PSBL usage policy |
Spamhaus is not queried, because its free service is limited to low-volume non-commercial use. For that reason a clean result here does not guarantee a clean reputation.
How to avoid or turn it off
- Use an SMTP plugin or mail service. The plugin then skips the check, because receivers see your mail service’s address, not your web server’s. This is the usual fix for mail problems anyway.
- Change the lists (developers). The
ecehc_dnsbl_zonesfilter replaces the list of blacklists. Return an empty list and no blacklist is queried. - Do not open the report or Site Health. The lookup only happens when one of them runs the checks. This is a workaround, not a setting.
There is no on/off switch for this check in the settings.
What the plugin keeps on your own site
The email log
- What is stored: the time of each email, which plugin sent it, its WooCommerce email type, whether it was accepted or failed, the recipient’s email domain, a partly hidden recipient address such as j***@example.com, and an error message with any addresses hidden the same way.
- What is never stored: the message, its subject, or a full email address.
- Where: in a table in your own database. It is not sent anywhere.
- How long: 7 days by default. You can choose 1, 3 or 7 days. The log is also capped in size, and old entries are removed daily.
- Control: in the Email Log tab you can turn logging off or clear the log at any time. Both need an administrator.
- Uninstalling: deleting the plugin removes the log table, its settings, and its other saved data.
- WordPress 5.9 or newer is needed for the log.
The plugin adds a suggested paragraph to your site’s privacy policy page (Settings > Privacy) that describes the log.
Other things saved on your site
Short-lived saved results (the mail-service detection and the blacklist answer, each for up to 12 hours), the time and result of your last test email, the log settings, and per-user choices such as hiding the checklist or the review request. All stay in your database.
Links that open WordPress.org
The plugin shows links to WordPress.org (for a review) and to your mail provider’s official setup guides. Nothing is sent when they are shown, only if you click.
Nothing is sent to us
The plugin has no usage tracking, no analytics, no account and no license check. It does not contact outboxhealth.com. The test email goes to the address you type, through your own mail setup.
Questions or corrections: see contact page.
Back to the plugin page.