Nucleus CMS

What is Nucleus CMS

Nucleus CMS is a free and open source content management system written in PHP and backed by a MySQL database. It was first released in the early 2000s as a blog focused publishing engine, with support for multiple weblogs, member accounts, comments, skins and plugins. The application is fully self hosted, meaning the website operator installs the code on their own web server, manages updates and acts as the sole data controller for every visitor or author who interacts with the site.

What data and cookies Nucleus CMS collects

By default Nucleus CMS sets a PHPSESSID session cookie when an authenticated session starts, a NP_Auth login cookie for the administration area and may set comment author cookies that store the visitor name, email and website on the public side. On the server it stores blog posts, drafts, member accounts (login, hashed password, email, real name), comments, IP addresses of commenters, referrer logs and any data added by third party plugins such as statistics modules or contact form extensions.

GDPR and ePrivacy implications

The administration session and login cookies are strictly necessary to deliver the editing service that the editor has requested, so they fall under the exemption of Article 5(3) ePrivacy Directive. Comment author cookies, statistics plugin cookies and any social or advertising integration however require prior informed consent. Storing the IP address of commenters and members triggers the GDPR, with a clear legal basis, a retention period and a privacy notice mandatory under Articles 6, 13 and 14.

Consent and user controls

On the public side, only the strictly necessary cookies should be set before consent. Comment author cookies, analytics plugins and any embedded media should be loaded after explicit opt in through a cookie banner with refusal as easy as acceptance. Members and commenters must be able to access, rectify and erase their data under Articles 15 to 17 GDPR, and a clear procedure should be documented to delete comments and member accounts on request.

Data transfers and hosting

Nucleus CMS is entirely self hosted, so there is no built in transfer to a vendor. The transfer question depends on where the operator runs the web server and the MySQL database. Hosting in the EU or EEA keeps the data inside the GDPR perimeter. Hosting in the United States, the United Kingdom or another third country triggers Chapter V of the GDPR and requires an adequacy decision, standard contractual clauses or binding corporate rules with a documented transfer impact assessment.

Practical compliance steps

Keep Nucleus CMS updated, prefer EU hosting, audit installed plugins for hidden tracking, configure a consent management platform to gate non essential cookies, set a short retention period for IP addresses in comment logs, restrict the administration backend through HTTPS and strong passwords, document the processing in the Article 30 records and update the privacy and cookie policy with a clear mention of Nucleus CMS, the categories of data, the recipients and the retention periods.