== External services ==

This plugin connects to the RankShield protection service (operated by SEO Elite Agency) to defend
your site against ranking-manipulation and ad-spend bot attacks. It is the core function of the
plugin and runs ONLY after you connect the site with an API key — a fresh, unconnected install makes
no external requests.

Service: RankShield API — https://sea-shield-production.up.railway.app
Provider / Terms / Privacy: https://rankshield.seoeliteagency.com  (Terms: /terms, Privacy: /privacy)

What is sent, and when:
  • GET /api/rules — on a 5-minute cron and on first page-load after activation. Sends your API key
    only (to fetch the current network blocklist). No visitor data is sent.
  • POST /api/event and /api/behavioral — when the firewall challenges a suspicious request. Sends
    the visitor IP, user-agent, requested URL, referrer and the block reason (the data needed to
    confirm and share an attacker). No names, emails, or account data are sent.
  • POST /api/helix/ingest — on the same 5-minute cron, in batches. Sends this site's own protective
    decisions (the attacker IP/prefix, the action taken, and the reason) so the site contributes to
    and benefits from the shared defense network. Same data class as above; no additional personal
    data is collected. Reported decisions are recorded only against this site and are never used to
    block traffic on other sites without independent corroboration.
  • POST /api/speed/css/jobs, GET /api/speed/css/status, GET /api/speed/css/result — ONLY when the
    paid Speed Optimization module's "Remove Unused CSS" feature is enabled. Sends the public URLs
    of your own pages so the RankShield service can render them and return only the CSS each page
    actually uses. No visitor data is sent; the service can only process URLs on your registered
    domain.
  • POST /api/wordpress/vulncheck — ONLY when the "Vulnerability Scan" module is enabled (off by
    default). Once a day, sends the slugs + version numbers of your installed plugins/themes and your
    WordPress version so the service can report which have a known published vulnerability (CVE). No
    file contents, no visitor data, no personal data — slugs and version numbers only.
  • Virtual-patch signatures ride the existing GET /api/rules bundle (no extra request): the service
    returns the exploit-blocking rules for known-vulnerable plugins, which the plugin applies locally.

Speed Optimization features may also fetch from third parties, only when you enable them:
  • Self-host Google Fonts — the SERVER downloads your Google Fonts CSS and font files once from
    fonts.googleapis.com / fonts.gstatic.com so your VISITORS never contact Google (a privacy
    improvement). Google's terms: https://developers.google.com/fonts/terms
  • YouTube facade — video thumbnails load in the visitor's browser from i.ytimg.com (the same host
    a normal YouTube embed uses); the full YouTube player loads only when the visitor clicks play.

All requests are authenticated with your site API key over HTTPS. You can disconnect at any time by
removing the API key, which immediately stops all external requests.
