FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

iThemes Security

EssentialOfficial website

iThemes Security, now known as Solid Security, is a WordPress security plugin that protects sites against brute force attacks, malware and unauthorised access. It logs IP addresses and login activity, sets security cookies, and can share IP addresses with a network brute force protection service. Because it processes personal data such as IP addresses, the GDPR applies, although its security cookies are generally treated as strictly necessary.

Block iThemes Security until consentScan my site
Overview

What does iThemes Security do?

What is iThemes Security?

iThemes Security, rebranded as Solid Security, is one of the most widely used security plugins for WordPress. It hardens a site against brute force attacks, enforces strong passwords and two factor authentication, scans for file changes and malware, and logs suspicious activity. It runs on your own WordPress server rather than as an external service.

What data and cookies does it collect?

The plugin logs IP addresses, usernames and timestamps of login attempts and other security events, which are personal data. It sets cookies related to login security and lockouts. If the network brute force protection feature is enabled, it reports offending IP addresses to the Solid Security network so that known attackers can be blocked across sites.

GDPR and ePrivacy implications

Logging IP addresses and security events is processing of personal data under the GDPR, but it can usually rely on legitimate interest because protecting the site is a clear and necessary purpose. The security cookies are generally treated as strictly necessary under Article 5(3) of the ePrivacy Directive, so they do not require consent, but you must still disclose the processing.

Consent requirements

Because the plugin cookies and IP logging serve site security, they are normally treated as strictly necessary and do not need prior consent. You should still inform visitors and users in your privacy notice that security logs and the network brute force feature process IP addresses, and set an appropriate retention period for the logs.

Data transfers

When the network brute force protection feature is enabled, offending IP addresses are shared with the Solid Security network, which operates from the United States. That transfer must rely on Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment. If you keep the plugin fully local, no transfer to a third country occurs.

Practical compliance steps

Decide whether to enable the network brute force protection feature, and if you do, document the US transfer and its safeguards. Set a retention period for the security logs, describe the IP logging and security cookies in your privacy notice, and rely on legitimate interest with a documented balancing test. Review the configuration when the plugin updates.

Compliance

iThemes Security and the GDPR

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR)
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law)

Impact assessment (DPIA)

iThemes Security logs IP addresses, usernames and timestamps of login attempts and other security events, which are personal data. Key DPIA considerations: (1) the security cookies are generally strictly necessary and do not require consent; (2) IP logging can rely on the legitimate interest of protecting the site; (3) the network brute force feature shares IPs with a service in the United States; (4) a retention period for the logs must be set. A DPIA is advisable for large scale logging.

Sample text for your banner

We use iThemes Security (Solid Security) to protect our site. The plugin logs IP addresses and login activity for security purposes and may share IPs with a network protection service in the United States. This security processing relies on our legitimate interest; you can find more details in our privacy notice.
Cookies and trackers

What iThemes Security sets and contacts

Tracking method
WordPress plugin (server side), security cookies and logs
Server location
Your own WordPress server (self hosted); network brute force protection shares data with Solid Security (United States)
Data transferred outside the EU
iThemes Security runs on your own WordPress server, so most processing is local. If the network brute force protection feature is enabled, IP addresses are shared with the Solid Security network in the United States, a transfer that must rely on Standard Contractual Clauses or the EU US Data Privacy Framework.

Cookies set (2)

NameTypeDurationPurpose
itsec_session_stateFunctional / SecuritySessionSupports login security and detects suspicious session activity.
itsec_bfSecurity1 daySupports brute force protection by tracking repeated failed login attempts from a device.

Third-party domains contacted (2)

  • solidwp.com
  • api.ithemes.com
Questions

Frequently asked questions about iThemes Security

Can't find your question? Write to us, we answer fast.

What cookies does iThemes Security set?

iThemes Security sets cookies related to login security and lockouts, which are generally treated as strictly necessary for protecting the site. Because they serve a security purpose, they usually do not require consent, but you should still describe them in your privacy notice.

Does iThemes Security require consent?

Usually not for the security cookies and IP logging, because they are strictly necessary to protect the site and can rely on legitimate interest. If you add non essential features such as external analytics, those would need consent. Always disclose the security processing.

What is the legal basis for iThemes Security?

The lawful basis for logging IP addresses and security events is normally legitimate interest under Article 6(1)(f) GDPR, supported by a balancing test, because site security is a legitimate and necessary purpose. The cookies are strictly necessary, so no separate ePrivacy consent is needed for them.

Does iThemes Security transfer data outside the EU?

A transfer occurs only if you enable the network brute force protection feature, which shares offending IP addresses with the Solid Security network in the United States. That transfer must rely on Standard Contractual Clauses or the EU US Data Privacy Framework. A fully local configuration involves no third country transfer.

Do I need a DPIA for iThemes Security?

A DPIA is usually not required for standard security logging, but it is advisable if you log at large scale or combine the logs with other monitoring. Documenting the IP logging, the retention, the legitimate interest balancing and any network feature transfer supports accountability.

How do I implement iThemes Security compliantly?

Configure iThemes Security with an appropriate log retention period, decide whether to enable the network brute force feature, and document the legitimate interest and any US transfer. Disclose the IP logging and security cookies in your privacy notice. Keep the plugin updated and review its data handling settings.

Are there alternatives to iThemes Security?

Other WordPress security plugins include Wordfence, Sucuri Security, All In One Security and MalCare. They all log IP addresses and security events as personal data, so the compliance approach is similar: legitimate interest, retention limits and disclosure, with attention to any external network features.

How do I update my cookie policy for iThemes Security?

You do not necessarily need a cookie policy entry for strictly necessary security cookies, but you should describe in your privacy notice that the plugin logs IP addresses and security events, the retention period, and whether the network brute force feature shares IPs with a US service. Keep this aligned with your configuration.

Same category

More services: Security

See the whole category

SecurityMetrics

SecureMetrics is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SecureMetrics supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SecureMetrics ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Digest

Digest is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Digest integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Digest helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Apereo CAS

Apereo CAS is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Apereo CAS offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Apereo CAS empowers organizations to optimize strategy and maximize return on investment.

Essential

MetaMap

MetaMap is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. MetaMap supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, MetaMap enables informed decisions that improve experience and drive results.

Essential

Fortinet FortiGate

Fortinet FortiGate is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. Fortinet FortiGate offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, Fortinet FortiGate strengthens your overall security posture.

Essential

ReCaptcha v2 for Contact Form 7

ReCaptcha v2 for Contact Form 7 is a form building and data collection platform that helps businesses create professional online forms, surveys, and questionnaires without coding. It offers a drag-and-drop builder, conditional logic, file uploads, and payment collection. ReCaptcha v2 for Contact Form 7 integrates with CRM, email marketing, and productivity tools to automate workflows triggered by submissions. With responsive designs and spam protection, ReCaptcha v2 for Contact Form 7 helps capture leads.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site