Support

Mandatory legal disclaimer: the following information does not constitute legal advice. The following information is provided as-is, for information purposes only. If you are unsure, please seek legal advice from a qualified lawyer.

IP addresses in security log files are specifically exempt in the GDPR regulation. You can store them even without the user's consent. This means that your server's access log, your server's error log and Admin Tools' security exceptions log are not subject to the GDPR provisions for consent.

It's still a good idea to not keep this information, however, longer than it's reasonably necessary. You can achieve that for Admin Tools in particular using the options of the System - Admin Tools plugin. Set it to keep only a small amount of records. For most sites 1000 records is more than enough to ensure security without storing information for an extended period of time.

Finally, note that storing permanently blocked IPs and the automatic IP blocking history does not violate the GDPR. The blocked IPs have not provided their real identities with their IP addresses, therefore their IP addresses are considered anonymous data under the GDPR.

----

I would also like to ask your consent in making this ticket public. It does not contain any personally identifiable information and its contents would be helpful to others. Please indicate in your next post if you agree for me to make this a public ticket.

It's the last option in your screenshot. Currently it's set to 0 which means "no limit". Set it to 1000 and let your site be accessed for a while (it only deletes 100 entries per page load to prevent an accidental database server overload).