← Back to 404 Solution

Privacy Policy — 404 Solution WordPress Plugin

This privacy policy covers the 404 Solution WordPress plugin and its optional Google Search Console integration. It explains what data is accessed, how it is handled, and how you can control it.

For the Forethought Studio website privacy policy, see forethought-studio.com/privacy.

1. What the plugin does

404 Solution is a WordPress plugin that automatically captures 404 (page not found) errors on your website and helps you create redirects for them. It can also suggest similar pages to visitors who land on broken URLs.

Optionally, the plugin can connect to Google Search Console to show you which broken URLs were receiving real search traffic, helping you prioritize which redirects to create.

2. Data processed by the plugin (non-Google)

404 request logs

  • The plugin logs 404 requests including the requested URL, referrer, and user agent.
  • IP addresses are hashed before storage using a one-way hash. The original IP address is never stored in the database.
  • All data is stored in your WordPress database on your own server. No data is sent to Forethought Studio or any third party.

3. Google user data

The Google Search Console integration is optional and is only activated when a site administrator explicitly connects their Google account. The four subsections below describe how this application accesses, uses, stores, and shares Google user data.

3.1 Data accessed

When a site administrator connects Google Search Console, the plugin requests the following OAuth scope:

  • https://www.googleapis.com/auth/webmasters.readonly: read-only access to Google Search Console data.

Using that scope, the plugin accesses the following Google user data on the administrator's behalf:

  • List of verified Search Console properties owned by the connecting account, used so the administrator can pick which property to associate with the WordPress site.
  • Search analytics metrics for individual URLs on the connected property: clicks, impressions, click-through rate (CTR), and average search position.
  • Google account email address and basic profile information returned by the OAuth handshake, used solely to display which account is currently connected and to allow the administrator to disconnect it.

The plugin does not request, access, or receive any other Google user data. It does not request Gmail, Drive, Calendar, Contacts, YouTube, Ads, Analytics, or any other Google service scope. It does not access search queries from Search Console, only URL-level metrics for URLs that have generated a 404 on the connected WordPress site.

3.2 Data usage

Google user data accessed by the plugin is used exclusively for the following purpose:

  • To display, inside the WordPress admin dashboard, which broken URLs (404s) on the administrator's own site were receiving real organic search traffic, so the administrator can prioritize which 404s to fix with redirects.

Specifically:

  • The plugin queries Search Console only for URLs that have already generated a 404 on the same WordPress site.
  • The retrieved metrics are displayed only to authenticated WordPress administrators of that site.
  • Google user data is not used for advertising, profiling, contact-list building, resale, or any purpose other than the 404-prioritization feature described above.
  • Google user data is not used to develop, improve, or train any generalized or non-personalized AI/ML models. It is not transferred to any AI/ML provider.
  • Google user data is not read by any human at Forethought Studio. It is processed entirely within the administrator's own WordPress installation.

3.3 Data storage and retention

  • OAuth tokens (access token and refresh token) are stored in the site's own WordPress database (the wp_options table) so the plugin can refresh access without re-prompting the administrator. Tokens never leave the administrator's own server except when sent directly to Google's token endpoint to refresh access.
  • Search Console metrics (clicks, impressions, CTR, average position) are cached in the site's own WordPress database for up to 1 hour, then automatically refreshed on next access. This cache exists solely to avoid hitting Google API rate limits.
  • No Google user data is stored on Forethought Studio servers, ever. The OAuth proxy described in section 4 processes tokens transiently and writes nothing to disk or any database.
  • When the administrator clicks "Disconnect" in the plugin, all stored tokens and cached Search Console data are deleted from the WordPress database immediately. Uninstalling the plugin also deletes all of this data.

3.4 Data sharing

Forethought Studio does not sell, rent, share, transfer, or disclose Google user data to any third party. Google user data accessed by the plugin is processed in only two places:

  • The administrator's own WordPress server, where the plugin runs and where the data is stored.
  • Google's own APIs, which the plugin calls directly from the WordPress server using the administrator's OAuth tokens.

The OAuth proxy at 404-solution-auth.forethought-studio.com sees OAuth tokens transiently during the authorization handshake and during token refresh, but does not store them and does not see Search Console data at any point.

3.5 Limited Use compliance

404 Solution's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Google Search Console authorization flow

The plugin uses a centralized OAuth application to simplify the Google Search Console connection. When the administrator clicks "Connect to Google Search Console," the authorization flow works as follows:

  1. The administrator's browser is redirected to an authorization proxy at 404-solution-auth.forethought-studio.com.
  2. The proxy redirects the browser to Google's consent screen, where the administrator reviews the requested webmasters.readonly scope and grants or denies access.
  3. If granted, Google sends an authorization code to the proxy, which exchanges it for access and refresh tokens via Google's token endpoint.
  4. The proxy redirects the browser back to the administrator's WordPress site, passing the tokens so the WordPress site can store them locally.

The authorization proxy does not store any Google user data. It processes tokens transiently during the authorization flow and during token refresh requests. No tokens, account information, or Search Console data are logged or retained on the proxy server.

Alternatively, the administrator can use their own Google Cloud OAuth credentials (available under "Advanced" in the plugin settings), which bypasses the proxy entirely. In that mode, the plugin connects directly from the WordPress server to Google's APIs.

5. Data retention

  • 404 logs: Retained according to your plugin settings. You can configure automatic cleanup or delete logs manually.
  • OAuth tokens: Stored in your WordPress database until you disconnect from Google Search Console.
  • Search Console data cache: Cached for 1 hour, then automatically refreshed.

6. Your rights

Because all data is stored in your own WordPress database, you have full control:

  • View: All captured 404s and redirects are visible in the plugin's admin interface.
  • Delete: You can delete individual log entries, clear all logs, or uninstall the plugin to remove all data.
  • Revoke Google access: Disconnect from Google Search Console in the plugin settings, or revoke access from your Google account permissions.

7. Children's privacy

This plugin is a website administration tool intended for use by site administrators. It does not collect data from website visitors beyond standard 404 request logging (with hashed IPs).

8. Contact

For privacy questions about the 404 Solution plugin, contact us at .

9. Updates to this policy

We may update this policy from time to time. The latest version will always be available at this URL.