WordPress (Core, Self Hosted)

What Core WordPress Is

WordPress core is the open source content management system in its default, self hosted form, without any additional plugins or third party services bolted on. It powers a very large share of the web and gives operators full control over where the site is hosted and what runs on it. Because it is self hosted and first party, the privacy footprint of a plain WordPress install is much smaller than many assume, and most of its data behaviour is decided by the choices the operator makes afterwards.

Cookies Set by Default

By default core WordPress sets first party cookies only for logged in users and for people who leave comments, using cookies such as wordpress_logged_in, wp-settings and comment_author. Anonymous visitors who simply read pages normally receive no cookies at all, which means a default WordPress site can be largely cookieless for the general public. This makes the baseline behaviour very privacy friendly compared with platforms that track every visitor from the first page view.

Hosting and Data Transfers

Self hosted WordPress runs on infrastructure the operator chooses, so data location is entirely under their control and core WordPress does not send data to any third country by itself. The software source is published at wordpress.org, but the running site serves content from the operator first party domain with no third party tracking by default. International transfers only appear if the operator selects overseas hosting or adds plugins and services that route data abroad.

Consent and Legal Basis

The login and comment cookies are strictly necessary for the functions the user is asking for, so they do not require prior consent and rest on necessity and legitimate interest. Consent only becomes relevant once the operator adds analytics, advertising, social embeds or other plugins that place non essential cookies or process data for additional purposes. In a clean default install there is usually nothing to consent to for anonymous visitors.

Compliance Risk and Considerations

The compliance risk of core WordPress is low, because the default cookies are first party, necessary and limited to authenticated users and commenters. The real risk in any WordPress project comes from what is added later, so the practical task is to keep an inventory of plugins and themes and to assess each addition that introduces tracking or transfers. Treating the core platform as the low risk baseline and watching the additions is the most accurate way to manage the project.

Keeping a WordPress Site Compliant

To keep a WordPress site compliant, start from the cookieless default and add only what you need, documenting every plugin, embed or analytics tool that changes the cookie or data picture. Where you add non essential cookies, place them behind a consent banner and update the cookie policy to reflect them, and choose hosting that keeps data in the region you intend. By preserving the lean default and controlling additions, you keep the platform simple, fast and easy to explain to visitors.