7. Security and Login Protection (Kadence Security)

We use the WordPress plugin “Kadence Security” (formerly “Solid Security”) to protect our website against unauthorised access, malicious requests and brute-force attacks. The enabled security functions include local brute-force protection, firewall rules, the blocking of suspicious or abusive access, two-factor authentication for authorised WordPress user accounts, security logging, lockout notifications and the enforcement of encrypted HTTPS connections.

When a security-relevant event occurs, the following data may be processed: IP address; date and time; requested URL; user agent; referrer and other request-header information; the username or user ID used in a login attempt, where applicable; login success or failure; the security rule or module triggered; and information concerning a lockout or ban. Normal page views are not entered in the plugin’s security logs unless they trigger a security rule or another security-relevant event.

Local brute-force protection and the firewall rules are used to identify and block repeated failed login attempts and suspicious requests. Depending on the number and type of security events, access associated with an IP address or username may be temporarily blocked. IP addresses or user-agent strings may also be added to a ban list, including for a longer period in the case of repeated security events.

Two-factor authentication applies only to persons with an authorised WordPress user account. When authentication through a time-based one-time password is used, the authentication code is generated by the user’s authenticator application. The corresponding authentication secret is stored in encrypted form in our WordPress database. Depending on the authentication methods enabled for the relevant account, authentication codes sent by email or backup codes may also be used.

Security log entries are stored in the database of our WordPress installation. According to the current configuration, these log entries are automatically deleted after 60 days. Information relating to a temporary lockout is retained until the lockout expires. Entries in the ban list are retained for as long as necessary to maintain the relevant ban and are deleted when the ban is lifted or is no longer required. The continued necessity of longer-term bans is reviewed periodically. Two-factor authentication data is retained for as long as two-factor authentication remains active for the relevant account and is deleted when two-factor authentication is disabled or the account is deleted, unless further retention is required by law.

If a user account or IP address is blocked for security reasons, designated website administrators may receive an email notification. Such notifications are processed through the email service used by us. Further information about the recipients of personal data is provided in Section 10 of this Privacy Policy.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are protecting the confidentiality, integrity and availability of our website and IT systems, preventing unauthorised access and detecting and defending against attacks and misuse. These measures also support compliance with the security requirements set out in Article 32 GDPR.

Security logs are stored within our WordPress installation hosted by Mittwald. Access is restricted to authorised administrators and the service providers identified in this Privacy Policy. Information about data subject rights, including the right to object under Article 21 GDPR, is provided in Section 13.