HTProtect sends no telemetry and no usage data. The only outbound connections are:

• Signature feed (update.wb-dev.de): downloads the exploit/malware signature lists. Plain download, can be switched off - then the built-in signatures are used.
• Joomla version check (downloads.joomla.org): reads the current Joomla version for the status indicator.
• Community report: only when you actively submit a false alarm / paths - never automatically, no IP reputation.
• Update finding report: if the auto-updater flags suspicious code in an update, the affected (public) extension file is sent once per version anonymously to website-bereinigung.de – for signature review, with no host, IP or personal data.
• Update feedback & block list: clicking „worked fine“ / „report a problem“ in an update email sends an anonymous signal (extension, version, verdict – no host/IP) to website-bereinigung.de. From this a signed block list of highly problematic update versions may be published, which HTProtect only READS and then does not install (no extra data sent, no remote intervention).
• Precautionary hold: if an update triggers the malware scan on several sites, radar can briefly mark it as „held back as a precaution“. HTProtect reads this small list (extension+version only, over verified HTTPS) and then silently does not install the affected version – purely preventive, security updates excepted, expires automatically. No data sent, no intervention in the running site.
• Outgoing e-mail (via your Joomla mailer): alerts and notifications to the configured address.

All core functions also work completely offline, without any of these connections.

No noticeable performance impact: the checks run mostly after the page has been delivered, in the background – resource-friendly, without a real cron job.

Exploit protection (WAF)

on every request (instant)

Watcher base run (.htaccess, warning list, accounts)

at most every 15 minutes

Signature feed (exploit + malware)

every 6 hours

Defacement / SEO spam check

every 6 hours

Integrity / anomaly check (entry points)

every 12 hours

Joomla version check

once a day

Cleaning up temporary files

once a day

Update notification (email)

checked every 6 h; email only when the list changes (same list at most every 14 days)

Extension auto-update (installation)

on your schedule – security updates immediately, selected updates after the grace period

The malware scan deliberately does NOT run automatically – only when you start it in the Scan area. The two auto-update rows only apply if you have enabled the respective feature (off by default).