Privacy Policy Generator for WordPress Sites
Enter your URL. We'll find the services collecting visitor data and generate the documents that disclose them.
Free scan and score. Privacy Policy, Terms and Cookie Policy for $19 one-time.
WordPress powers a large share of the web, and the plugin ecosystem is where most of the data collection happens. A typical business site runs Google Analytics through Site Kit or MonsterInsights, a contact form from WPForms or Contact Form 7, reCAPTCHA to stop spam, and Jetpack, which reports visitor statistics back to Automattic. Blog comments store names, emails and IP addresses, and Gravatar requests share a hashed email with a third party for every avatar displayed.
Embedded media adds another layer. YouTube embeds set advertising cookies on your pages even when the video is never played. Mailchimp signup forms load a script that identifies subscribers across visits. If your host or CDN is Cloudflare, security cookies are set before WordPress renders anything. Sites with WooCommerce or membership plugins also handle account registration and payments through Stripe or PayPal.
WordPress does not ship a privacy policy; the built-in privacy page is a stub with placeholder text. VerifiedPrivacy fetches your homepage the way a browser does, identifies which of these services are actually loading, and generates a Privacy Policy, Terms of Service and Cookie Policy that name each one and explain what it collects. The questionnaire takes about two minutes and covers accounts, comments, EU and California visitors. Paste your site address below to see what your plugins are sending.
Frequently asked questions
Does WordPress come with a privacy policy?
Not a usable one. WordPress creates a draft Privacy Policy page with suggested headings and placeholder text that you are expected to complete yourself, and it does not update when you install plugins. VerifiedPrivacy scans the live site, detects the analytics, form, embed and commerce services present, and generates a complete Privacy Policy, Terms of Service and Cookie Policy from a clause library. Attorney review is recommended before you publish.
Do I need to disclose blog comments and Gravatar in my privacy policy?
Comments collect a commenter's name, email address and IP address, and WordPress sets cookies to remember them. Gravatar sends a hashed version of each commenter's email to Automattic to fetch an avatar. Both are personal data processing in most frameworks, so the generated policy includes a user-content section when you indicate that visitors can post, and names the relevant service disclosures the scan detects.
Does the scan detect plugins directly?
The scanner reads the public homepage as a browser would and matches script sources, iframes, forms and cookies against known service signatures. It identifies the third-party services plugins load, such as Google Analytics, reCAPTCHA, Mailchimp, YouTube embeds, Stripe and WooCommerce, rather than listing plugin names. Plugins that only affect the admin area or logged-in pages will not be visible from the homepage.
Do I need a cookie notice on a WordPress site?
If you have visitors in the EU or UK and your site sets non-essential cookies, for example through Google Analytics, YouTube embeds or Meta Pixel, a consent banner is generally expected before those cookies load. Many WordPress sites use Complianz, CookieYes or Cookiebot for this. The coverage score warns when cookie-setting services are present, you have indicated EU traffic, and no consent tool is detected.
How do I add the generated policy to WordPress?
Download the HTML version, create or open your Privacy Policy page in WordPress, switch the editor to code view and paste it in. Do the same for Terms of Service and Cookie Policy, then link all three from your footer. The Markdown and Word versions are included for editing and for attorney review. Your download link is permanent, so you can regenerate and repaste after changes.
Other guides
VerifiedPrivacy generates documents from a clause library. It is not a law firm and does not provide legal advice. Have a licensed attorney review documents before use.