PIIP (PII Protection) is a plugin that automatically detects and masks personally identifiable information (PII) in WordPress comments and community plugin content before the data is saved to your database. This helps protect user privacy and supports your compliance efforts under privacy regulations such as the GDPR. Note that PIIP is a technical tool and does not by itself make your site GDPR compliant.

Key Features

Automatic PII Detection: Intelligently detects multiple types of PII including emails, phone numbers, addresses, credit cards, SSN/My Number, passwords, API tokens, IP addresses, and hosting account IDs
Server-Side Masking: All masking happens on the server (PHP) for maximum security – cannot be bypassed by users
WordPress Core Support: Native support for WordPress comments
Community Plugin Support: Works seamlessly with wpForo, BuddyPress, bbPress, and other popular community plugins
Configurable: Choose which PII types to mask via easy-to-use settings page
Consent Opt-Out: Users can include consent phrases to skip masking when sharing personal info publicly
Presidio-Level Detection: High-accuracy detection with validation (Luhn for credit cards, check digits for My Number)
Retroactive Scan: Scan content that existed before installing PIIP and apply masking after a dry-run review
Custom Patterns: Mask site-specific identifiers (employee IDs, member numbers) with your own regular expressions
WP-CLI Support: wp piip mask and wp piip scan commands for automation and large sites

Supported PII Types

Email addresses ([email protected] e***@domain.com)
Phone numbers (Japanese mobile/landline, international formats)
Japanese street addresses in free text (東京都新宿区西新宿2-8-1 東京都) and labeled postal codes (〒123-4567 〒-****)
Credit card numbers with Luhn validation (4532-1234-5678-9010 ****-****-****-9010)
Social Security Numbers / Japanese My Number with check digit validation
Passwords, including labeled values in free text (password: xxx / パスワードは xxx [REDACTED])
HTTP credentials: Basic auth (curl -u, Authorization: Basic, user:pass@host URLs) and Bearer tokens (including JWTs)
Developer secrets: GitHub, Slack, AWS, Stripe tokens and SSH/PEM private key blocks
API Tokens/Keys (partial masking showing first and last 4 characters)
AI API Keys (OpenAI sk-***, Anthropic sk-ant-***, Google AIza***, Hugging Face hf_***, Replicate r8_***, Cohere, Azure OpenAI)
Labeled dates of birth (生年月日: 1990-01-15 ****-–)
Labeled bank account numbers (口座番号: 1234567 ***4567)
Names in self-introduction phrases (山田太郎と申します山***と申します; opt-in, off by default)
IP Addresses (192.168.1.1 192..1)
Hosting Account IDs (XServer, Sakura, AWS, Azure, GCP, ConoHa, Lolipop, mixhost)

Supported Integrations

WordPress Core
- Comments
- User Profiles (display name, nickname, biographical info)
Form Plugins
- Contact Form 7 (free-text fields; protects sent mail and stored copies such as Flamingo)
Community Plugins
- wpForo Forum
- BuddyPress
- bbPress
More integrations coming soon!

How It Works

User posts a comment or content in a community plugin
PIIP intercepts the submission before database save
Automatically detects PII using field names, regex patterns, and validation
Masks detected PII according to your settings
Content saves normally with masked data

Privacy & Security

All processing happens on YOUR server (no external API calls)
Original values are NEVER stored for maximum privacy protection
Server-side processing prevents client-side bypass attempts
Full control over your data

Privacy Policy

PIIP – PII Protection does NOT:
* Send any data to external servers
* Track users
* Use cookies
* Share data with third parties

PIIP DOES:
* Process content locally on your server
* Automatically mask PII without storing sensitive data

Support

For support, bug reports, or feature requests:
* Website: https://github.com/benridane/piip

Development

Development happens on GitHub. Pull requests welcome!
* Follow coding standards
* All code must pass composer run phpcs