This page is about the FuseHub Site plugin only. FuseHub Site is made by FuseHub. Contact: contact@fusehub.ai.
When it sends anything
FuseHub Site asks FuseHub’s update server, updates.fusehub.ai, whether there is a newer version: when WordPress checks for updates (WordPress plans these checks twice a day, and also checks when someone opens the Plugins or Updates screens and it has not checked recently), and while it installs an update. It never asks as part of showing a page to a visitor: WordPress’s scheduled checks run in the background, though a visit to your site is often what starts them. A site with a local address, such as mysite.local, asks nothing.
What each request carries
- The address it asks for, the same for every site. While installing an update, that address names the update’s version.
- The name “FuseHub-Site”, where WordPress would otherwise put its version and your site’s address.
- The internet address of the server your site runs on, and when it asks. Any server your site connects to can see both. Some hosting companies give each site its own address; there, the address on its own can point to your site.
- The standard technical details WordPress sends with any request, which describe your server’s software, not your site.
What it does not send
Your site’s web address or name, your email address, your users, your content, your other plugins, which versions of WordPress or PHP you run, or which version of FuseHub Site you run now. It sends nothing about your visitors, sets no cookies, and loads nothing from FuseHub into your pages.
The update list
The update list FuseHub publishes is the same for every site, and anyone can read it. So that a few sites FuseHub picks, its own and sites it looks after for its clients, get a new version first, it names them, and it can name a site FuseHub is holding back from a version known to cause that site trouble. It names a site by a scrambled form of a random code FuseHub stored in that site’s database, mixed with the site’s own address. Without the code, nobody can tell from the list which sites it names, and a copy of a site at another address does not match. Your site checks the list itself and sends nothing to do so. The service that serves the update files can still tell, from which servers download a new version before it is offered to every site, which servers those early sites run on.
The code in your site
When FuseHub sets a site up, it stores a random code in the site’s database, as the setting fusehub_site_update_code. Anyone who can see the site’s settings or its database can see the code: its administrators, its host, other plugins on it, and anyone with a backup or a copy of the site, including a copy made to start another site. With the code and the site’s address, they can tell whether FuseHub’s update list names the site. FuseHub Site never sends the code anywhere. The FuseHub app’s assistant can read it, like any of the site’s settings, when someone using the app asks it to work on that site. Deleting or changing the code stops your site matching the list: it is then neither offered a new version early nor held back from one, including a version FuseHub held back because it causes your site trouble. The list can still carry the scrambled entry FuseHub made for your site until FuseHub removes it, and anyone with an older copy of your database can still recognise that entry.
Who sees the requests
- Cloudflare, which hosts updates.fusehub.ai for FuseHub. Cloudflare’s privacy policy is at https://www.cloudflare.com/privacypolicy/.
- fusehub.ai’s DNS provider, which answers the lookups of the name updates.fusehub.ai.
- Your hosting company’s network, as with any connection your server makes.
- FuseHub runs no program on the update server, which only hands out the same files to every site.
What FuseHub keeps
The FuseHub app keeps, on the computer it runs on, the code it stored in each site it set up, and does not send it to FuseHub. It also keeps there copies of a site’s database that it takes before some of its changes, among them a backup taken before the site’s weekly clean-up first deletes old revisions; of the backups it takes by itself, it keeps the latest five of each kind for each site, and deletes older ones as it takes new ones. On FuseHub’s own publishing computer, FuseHub also keeps, for each site it names in an update list (the sites it picks to get new versions first, and any it is holding back), the web address that site runs at and its code. Neither is published; the list shows only the scrambled form. FuseHub keeps both after the list stops naming a site, until FuseHub deletes them; nothing deletes them on its own. The update checks themselves give FuseHub no list of the sites that use the plugin.
Things outside the plugin
- Other plugins on your site can change any request WordPress sends. This page describes what FuseHub Site itself sends.
- WordPress’s own update check tells wordpress.org which plugins your site has, FuseHub Site included, along with your site’s address. That is WordPress’s behaviour, and FuseHub does not receive it.
- WordPress emails your site’s admin address after automatic updates, naming FuseHub Site. Those emails go from your own site; FuseHub does not see them.
Stopping it
Turning off auto-updates on the Plugins screen stops automatic installs; the plugin still asks whether there is an update. Deactivating or deleting the plugin stops every request to FuseHub.
Changes
If a later version of FuseHub Site sends anything more, its own “What this plugin sends” and this page will say so before that version is released.
Last updated: 8 November 2026