External Services and Privacy

GT Performance works entirely on your server by default and sends no data anywhere. Each integration below contacts a third-party service only after you enable it and, where credentials are involved, only with credentials you supply. There is no telemetry, no account requirement, and the plugin never contacts servers of its own.

Cloudflare API: api.cloudflare.com

Contacted only when you connect your own Cloudflare account to manage its cache rule and purge its cache.

Sends: the API token, or the Global API Key and account email, you saved; your zone identifier or domain; the compiled cache-rule expression; this site’s hostname when the connection check looks up its DNS records; and the exact URLs or this site’s hostnames being purged. When: connecting, synchronizing (from the Cloudflare tab, the Dashboard or Setup), previewing the rule plan, running the connection check, creating a scoped token from a saved Global API Key, disconnecting, deactivating the plugin while Cloudflare is connected (to delete this site’s rule and purge its hostnames), and purging, including automatically when a content change requires an edge purge and on scheduled retries of a failed purge. Provider: Cloudflare, Inc. (Terms · Privacy)

The Create token at Cloudflare and help links open Cloudflare pages in your own browser; your server sends nothing for them. See Cloudflare.

xCloud hosting API: app.xcloud.host

Contacted only when you connect a site hosted on xCloud using your own xCloud API token.

Sends: that token and your site’s domain or xCloud identifier. When: connecting or refreshing the integration, and when host-level caches are purged after a GT Performance purge. Provider: xCloud by WPDeveloper (Privacy)

See xCloud.

Google Fonts: fonts.googleapis.com, fonts.gstatic.com

Contacted only when you enable local Google Fonts hosting on a site whose theme or plugins already load Google Fonts. Your server downloads the stylesheet and font files once and serves them from your own domain afterward.

The download is a server-side request that carries no visitor data, and the feature removes your visitors’ browser requests to Google entirely. Provider: Google LLC (Privacy · Google Fonts privacy notes)

YouTube: i.ytimg.com, www.youtube-nocookie.com

Involved only on pages where you have already embedded a YouTube video and the lightweight embed option is on. The visitor’s browser loads the video thumbnail from i.ytimg.com, and the player loads from the privacy-enhanced youtube-nocookie.com domain only after the visitor clicks play.

Your server sends nothing to YouTube. Without this option the standard YouTube embed would contact YouTube earlier and more broadly. Provider: Google LLC (Terms · Privacy)

Optional AI features

Both are off by default and send nothing unless an administrator acts. Details: AI and MCP.

• AI adviser (WordPress 7.0 or later). Sends a redacted diagnostic report through the WordPress AI Client to the AI provider configured in WordPress, only after an administrator reviews exactly what will be sent and presses Send. GT Performance stores no AI credentials of its own.
• Assistant access over MCP or REST (WordPress 6.9 or later). An assistant you connect yourself calls into your site with an Application Password you create. GT Performance contacts no AI service for this, and ability responses never include credentials. An operation the assistant is allowed to run, such as a purge, can in turn contact Cloudflare or xCloud exactly as above.

Nothing is sent to an AI provider automatically, from visitors, or from scheduled tasks.

Requests to your own site

GT Performance also sends requests to your own site’s URLs for cache warming, preloads, CSS generation, purge verification, and the Setup tab’s Detect host cache and Verify buttons, which fetch your home page as a visitor. The connection check on the Cloudflare tab may also fetch your home page to look for Cloudflare’s CF-Ray header. They are addressed to your own domain, passing through whatever proxy or CDN already sits in front of it.

When a CDN URL is configured, the unused-CSS engine may also read your own stylesheets from that CDN hostname. Fetch important CSS classes opens sample pages of your site in your own browser.

Hostnames that are matched, not contacted

GT Performance stores script hostname patterns such as connect.facebook.net, googletagmanager.com, google-analytics.com, clarity.ms, and hotjar.com.

These are matching rules, not connections. They are compared against the script URLs your own site already loads:

• The default Scripts to delay list uses them to choose which third-party scripts wait for the visitor’s first interaction when JavaScript delay is on.
• When a supported analytics or pixel plugin is active, its hostnames become exclusions instead, so that plugin’s tracker is never minified, deferred, or delayed. See Integrations.

GT Performance never contacts these hosts, sends them no data, and adds no script to your site that would. See JavaScript Optimization.