~ digitalchk / docs / breach-chk
Breach Chk tells a visitor whether their email address has appeared in a known data breach, and turns that answer into a written report. It queries Have I Been Pwned, groups the results by how much they expose, and explains what each breach actually leaked.
How it works
Breach lookup
The address is checked against the Have I Been Pwned database, which needs an HIBP API key.
Paste lookup
Separately reports appearances in public paste sites, which often surface sooner than a formal breach disclosure.
Risk grouping
Findings are grouped by what was exposed, so a leaked password weighs more than a leaked newsletter signup.
Password check
A separate shortcode checks a password against known compromised lists using the k-anonymity range API, so the password itself never leaves the browser in full.
Breach monitoring
Below the result, visitors can ask to be emailed when their own address shows up in a new breach. They tick that they manage the address and confirm it with a code. The check runs on the schedule you pick in the Monitoring submenu (every 6 or 12 hours, daily, every 3 days or weekly; daily by default), backs off and retries when Have I Been Pwned fails or rate limits, and only reports breaches added after sign up. Two days after an alert, a follow-up repeats what was found in case it was missed. Links in these emails ask for confirmation before stopping anything, because mail security scanners open every link. Monitoring is part of the newsletter: unsubscribing stops it.
Auto-publisher
Can draft and publish posts about notable breaches, with AI-written copy and a generated featured image. Text works with any AI service with a Chat Completions API, with a Reasoning effort setting for reasoning models, and images with any standard image-generation API. Each can have a backup provider that takes over when the main one fails. Posts are left as drafts by default. Deleting a draft tells the publisher no: it remembers that breach and never writes it again, and restoring the draft from the trash undoes it. Turn this off or forget the remembered list in Auto-Publisher > Deleted articles.
Requirements
- WordPress 5.8 or newer
- PHP 7.4 or newer
- An API key for Have I Been Pwned, which is a paid service
Publishing it
Drop one of these shortcodes on any page or post. Each one is self-contained and needs no theme integration.
[breach_chk][breach_checker][breach_catalog][password_checker]
Attribution. The plugin shows a small “A tool by Digital Checkmark” line, with a link to digitalchk.com, under the widget, at the foot of the PDF report and under every email it sends. It is part of the plugin and has no setting to turn it off. If a tool and a Leads Chk form share a page, the line shows once.
Setup
Anti-abuse Recommended
Under Settings, add your Cloudflare Turnstile site key and secret key. Without it, anyone can script the public tool and consume your quotas on the outside services it uses.
With the keys in place, the plugin also refuses to email a verification code or a report unless the visitor recently passed a Turnstile check. A normal search counts; if not, a small check window opens before sending.
Email verification Recommended
The plugin verifies in three layers before sending a report: format, disposable domain, and, if you add a Reoon key, a real deliverability check. This protects your sending reputation from bounces to invented addresses.
PDF reports Optional
Reports are converted to PDF by Gotenberg, which you self-host. Set its URL in the reports tab; on the same machine that is http://127.0.0.1:3000. Without Gotenberg the rest of the plugin works unchanged.
Delivery and branding
Configure the SMTP server that sends the reports and the branding that appears on them: name, tagline, logo, colors and cover.
Notifications and contacts Optional
It can notify you by email or webhook when a lead arrives and, if you use Leads Chk, hand that lead to it, which keeps your contacts and your newsletter. Everything filters by event and by source, so you are not paged for noise.
Usage wall with a code Optional
Free uses are counted on the server, and you choose how many, so a private window does not reset them. Past the limit the visitor confirms an email address with a 6-digit code, and the tool unlocks for the rest of the day. Code requests and wrong attempts are limited, with a temporary lock. An address nobody verified is never saved as a lead.
Lead capture and retention
When somebody asks for their report, the plugin stores the address as a lead along with a summary of the result, and builds the report only from the result the server kept when the check ran (for up to 2 hours), so it always matches what the tool found. You will find these under Leads, and they export to CSV.
Retention is governed by GDPR Retention (days): leads older than that are deleted automatically by a scheduled task. Set it to 0 to disable the purge, though we would not recommend it. Declare in your privacy policy what you store and for how long.
The plugin also works with the WordPress privacy tools (Tools > Export Personal Data and Erase Personal Data): one request exports or deletes everything it keeps for an email address, together with the other Digital Checkmark plugins you have installed.
If Leads Chk is installed, every address the plugin collects through a report, the usage wall or the access gate is also sent there, with tags (the tool, how the address arrived, business or personal, and the result) and a consent record. What happens next (saved only, newsletter offered with a checkbox, or subscribed) and which list it goes to is decided in this plugin’s Integrations screen. Addresses that were only looked up, and could belong to someone else, stay out of Leads Chk. Leads Chk can also place a newsletter form under the tool.
If something does not work
The tool reports no breaches for an address you know is breached.
Confirm the HIBP key is present and valid. Without it the lookup cannot run, and the plugin reports the failure rather than an empty result.
Getting help
Write to us through the support page. Include your plugin version, your WordPress and PHP versions, and the exact text of any error.