> How Sucuri handles personal data: WAF and CDN cookies, US data residency, the GDPR security interest under Recital 49 and Standard Contractual Clauses. > > Canonical: https://www.flowconsent.com/en/services/cdn/sucuri CDN # Sucuri Unclassified · [Official website](https://sucuri.net/) Sucuri is a US-based website security suite (now owned by GoDaddy) combining a cloud Web Application Firewall (WAF), a CDN, malware scanning and removal, and uptime monitoring. Sucuri proxies all incoming traffic through its global edge network, inspecting requests for attacks and serving cached content. It is widely used by WordPress, Joomla, and Magento sites for hardening and incident response. [Block Sucuri until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cdn) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CDN](https://www.flowconsent.com/en/services/cdn) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 5 - Servers United States (Sucuri Inc., a GoDaddy company, headquartered in Menifee, California) with a global edge network for the firewall and CDN tier Overview ## What does Sucuri do? ## **What Sucuri is** Sucuri is a US-based website security platform, founded in 2010 and acquired by GoDaddy in 2017. It bundles a cloud Web Application Firewall (WAF), a global CDN, malware scanning and removal, uptime monitoring, and incident response services. The protected site updates its DNS to point to the Sucuri edge, which proxies all HTTP traffic, applies the WAF rules, and serves cached content. Sucuri is particularly popular among WordPress, Joomla, and Magento sites in EU and US markets. ## **What data Sucuri processes** At the WAF/CDN layer: every HTTP request transiting to the protected site, including the IP address, user agent, URI, request headers, and (when full logging is enabled) the request body. At the management plane: site owner identity, scan results, malware findings, and configuration history. The WordPress plugin (sucuri-scanner) processes core file inventories, admin user activity, and security events on the host server. ## **GDPR and ePrivacy implications** IP addresses are personal data under GDPR. The processing falls under the security exemption recognised by Recital 49 GDPR and relies on legitimate interest (Art. 6(1)(f)). The cookies Sucuri sets (sucuri\_cloudproxy\_uuid, etc.) are functional and tied to the WAF logic, generally qualifying for the strict service-delivery exemption of Art. 5(3) ePrivacy. A Legitimate Interest Assessment is recommended to document the necessity and proportionality. ## **International data transfers** Sucuri operates a global CDN with EU PoPs, but the management plane, logs and threat intelligence are centralised in the United States under GoDaddy. Transfers from the EU rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework certification of GoDaddy. A Transfer Impact Assessment is recommended for sites in sensitive sectors. ## **Practical compliance steps** Sign the Sucuri (GoDaddy) DPA, confirm SCCs and DPF, run an LIA, document a short DPIA if you enable full request body logging, configure the cache to bypass authenticated pages with personal data, exclude payment forms from caching, mention Sucuri in the privacy notice as a security processor with US transfer, and document the WordPress plugin in the RoPA. Compliance ## Sucuri and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR), with the security exemption of Recital 49 GDPR for network and information security - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), Recital 49 GDPR, CCPA, PCI DSS (where the site processes payments) ### Impact assessment (DPIA) Sucuri inspects every HTTP request to the protected site, processing IP addresses, request payloads, user agents, and (optionally) WordPress admin user activity through the plugin. Key DPIA considerations: (1) the WAF can log POST bodies, which incidentally include personal data submitted via forms; (2) IP addresses are systematically processed, with retention configurable in the Sucuri dashboard; (3) the centralised threat intelligence is hosted in the US under GoDaddy operational control; (4) the CDN caches responses, which can include personal data in the page output of authenticated pages if not properly excluded; (5) the WordPress plugin (sucuri-scanner) requires admin access and processes site file inventories. A DPIA is recommended for high-traffic sites and any deployment that enables full request body logging. ### Sample text for your banner > Our website is protected by Sucuri, a US-based website security service (a GoDaddy company). All incoming traffic transits through Sucuri to detect and block attacks. To do this, Sucuri processes your IP address, user agent, and request details. The processing relies on our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR, Recital 49). Transfers to the United States are governed by Standard Contractual Clauses and the EU-US Data Privacy Framework. Cookies and trackers ## What Sucuri sets and contacts - Tracking method Cloud-based Web Application Firewall (WAF) and CDN proxying all traffic, plus optional WordPress plugin (sucuri-scanner) for server-side scanning - Server location United States (Sucuri Inc., a GoDaddy company, headquartered in Menifee, California) with a global edge network for the firewall and CDN tier - Data transferred outside the EU Sucuri proxies all visitor traffic through its global CDN, with PoPs in multiple regions including the EU. Logs, threat intelligence, and management plane data are centralised in the United States. As a GoDaddy company, processing is subject to GoDaddy data protection terms. Transfers from the EU rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------------ | --------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | sucuri\_cloudproxy\_uuid | Functional / Security | 1 year | Unique identifier set by the Sucuri Web Application Firewall to recognise a returning visitor and apply consistent firewall rules and rate limits across requests. | | sucuri\_protect\_\* | Functional / Security | Session | Short-lived session cookies used by the Sucuri WAF to confirm that a request comes from a previously challenged browser, avoiding repeated CAPTCHAs. | | sucuri\_session | Functional / Security | Session | Maintains the security session between the visitor browser and the Sucuri edge for the duration of the visit. | ### Third-party domains contacted (5) - `sucuri.net` - `www.sucuri.net` - `cloudproxy.sucuri.net` - `firewall.sucuri.net` - `sitecheck.sucuri.net` Questions ## Frequently asked questions about Sucuri Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Sucuri set? Sucuri sets a small number of functional cookies (sucuri\_cloudproxy\_uuid, sucuri\_protect\_\*) used to identify a returning visitor and apply firewall rules consistently. These cookies are functional and tied to the security purpose. ### Does Sucuri require user consent? Generally no. The cookies fall under the strict service-delivery exemption of Art. 5(3) ePrivacy and the data processing relies on legitimate interest under Recital 49 GDPR. Document the LIA and mention Sucuri in the privacy notice. ### What is the legal basis for using Sucuri? Legitimate interest (Art. 6(1)(f) GDPR), with the security exemption of Recital 49. Document a short LIA covering necessity, proportionality, and the rights of the data subjects. ### Does Sucuri transfer data to the United States? Yes. The management plane and logs are hosted in the US under GoDaddy operational control. Transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework. ### Do I need a DPIA for Sucuri? For typical deployments, no. Document a DPIA if you enable full request body logging (which incidentally captures personal data from forms) or if you are in a sensitive vertical (health, public sector, finance). ### How do I implement Sucuri compliantly? Sign the GoDaddy DPA, confirm SCCs and DPF, configure CDN cache rules to bypass authenticated pages with personal data, exclude payment forms from caching, document the LIA, mention Sucuri in the privacy notice, and document the WordPress plugin scope in the RoPA. ### What are the alternatives to Sucuri? EU and EU-friendly alternatives include Cloudflare WAF (US headquartered, EU PoPs), Imperva Cloud WAF, Akamai Web Application Protector, Fastly Next-Gen WAF, Patchstack (Estonia), Wordfence (US), and self-hosted ModSecurity with OWASP Core Rule Set. ### How do I update the cookie policy for Sucuri? List the Sucuri functional cookies under the strictly-necessary or security section of your cookie policy, with name, purpose, duration, and a mention of the US data transfer with SCCs and DPF. State that no consent is required because the processing is based on legitimate interest with the security exemption. Same category ## More services: CDN [See the whole category](https://www.flowconsent.com/en/services/cdn) ### [ImageEngine](https://www.flowconsent.com/en/services/cdn/imageengine) [ImageEngine is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ImageEngine integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ImageEngine helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/imageengine) [CDN](https://www.flowconsent.com/en/services/cdn/imageengine) · ### [cdnjs](https://www.flowconsent.com/en/services/cdn/cdnjs) [cdnjs is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. cdnjs is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, cdnjs offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/cdn/cdnjs) [CDN](https://www.flowconsent.com/en/services/cdn/cdnjs) · ### [Fork Awesome](https://www.flowconsent.com/en/services/cdn/fork-awesome) [Fork Awesome is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Fork Awesome integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Fork Awesome helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cdn/fork-awesome) [CDN](https://www.flowconsent.com/en/services/cdn/fork-awesome) · ### [Microsoft Ajax Content Delivery Network](https://www.flowconsent.com/en/services/cdn/microsoft-ajax-content-delivery-network) [Microsoft Ajax Content Delivery Network is a shipping and fulfillment solution that helps e-commerce businesses streamline their delivery operations. It offers real-time shipping rate calculations, automated label generation, package tracking, and multi-carrier support. Microsoft Ajax Content Delivery Network integrates with major e-commerce platforms and marketplaces, enabling merchants to optimize shipping costs, improve delivery times, and provide customers with transparent tracking. Its warehouse.](https://www.flowconsent.com/en/services/cdn/microsoft-ajax-content-delivery-network) [CDN](https://www.flowconsent.com/en/services/cdn/microsoft-ajax-content-delivery-network) · ### [AWS CloudFront](https://www.flowconsent.com/en/services/cdn/aws-cloudfront) [AWS CloudFront is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. AWS CloudFront is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, AWS CloudFront offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/cdn/aws-cloudfront) [CDN](https://www.flowconsent.com/en/services/cdn/aws-cloudfront) · ### [Acquia Cloud Platform CDN](https://www.flowconsent.com/en/services/cdn/acquia-cloud-platform-cdn) [Acquia Cloud Platform CDN is a content delivery network (CDN) that accelerates website performance by distributing content across a global network of edge servers. It reduces latency, improves page load times, and handles traffic spikes by serving cached content from the nearest location. Acquia Cloud Platform CDN supports static and dynamic content acceleration, DDoS protection, and SSL/TLS encryption. With real-time analytics and purge capabilities, Acquia Cloud Platform CDN ensures fast, reliable delivery.](https://www.flowconsent.com/en/services/cdn/acquia-cloud-platform-cdn) [CDN](https://www.flowconsent.com/en/services/cdn/acquia-cloud-platform-cdn) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)