> Learn which cookies a default WordPress install sets, why core functional cookies usually need no consent, and how plugins change your compliance duties.
>
> Canonical: https://www.flowconsent.com/en/services/cms/wordpress-default

CMS

# WordPress (Core, Self Hosted)

Unclassified · [Official website](https://wordpress.org/themes/default)

WordPress Default describes the cookies a plain core WordPress install sets, which are strictly necessary functional cookies for logged in users and commenters that generally do not require consent.

[Block WordPress (Core, Self Hosted) until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [CMS](https://www.flowconsent.com/en/services/cms)

- Consent

  Unclassified

- Prior consent

  Not required

- Documented cookies

  6

- Third-party domains

  4

- Servers

  Self hosted on the server chosen by the site owner, so the location depends on the hosting provider

Overview

## What does WordPress (Core, Self Hosted) do?

## **What Core WordPress Is**

WordPress core is the open source content management system in its default, self hosted form, without any additional plugins or third party services bolted on. It powers a very large share of the web and gives operators full control over where the site is hosted and what runs on it. Because it is self hosted and first party, the privacy footprint of a plain WordPress install is much smaller than many assume, and most of its data behaviour is decided by the choices the operator makes afterwards.

## **Cookies Set by Default**

By default core WordPress sets first party cookies only for logged in users and for people who leave comments, using cookies such as wordpress\_logged\_in, wp-settings and comment\_author. Anonymous visitors who simply read pages normally receive no cookies at all, which means a default WordPress site can be largely cookieless for the general public. This makes the baseline behaviour very privacy friendly compared with platforms that track every visitor from the first page view.

## **Hosting and Data Transfers**

Self hosted WordPress runs on infrastructure the operator chooses, so data location is entirely under their control and core WordPress does not send data to any third country by itself. The software source is published at wordpress.org, but the running site serves content from the operator first party domain with no third party tracking by default. International transfers only appear if the operator selects overseas hosting or adds plugins and services that route data abroad.

## **Consent and Legal Basis**

The login and comment cookies are strictly necessary for the functions the user is asking for, so they do not require prior consent and rest on necessity and legitimate interest. Consent only becomes relevant once the operator adds analytics, advertising, social embeds or other plugins that place non essential cookies or process data for additional purposes. In a clean default install there is usually nothing to consent to for anonymous visitors.

## **Compliance Risk and Considerations**

The compliance risk of core WordPress is low, because the default cookies are first party, necessary and limited to authenticated users and commenters. The real risk in any WordPress project comes from what is added later, so the practical task is to keep an inventory of plugins and themes and to assess each addition that introduces tracking or transfers. Treating the core platform as the low risk baseline and watching the additions is the most accurate way to manage the project.

## **Keeping a WordPress Site Compliant**

To keep a WordPress site compliant, start from the cookieless default and add only what you need, documenting every plugin, embed or analytics tool that changes the cookie or data picture. Where you add non essential cookies, place them behind a consent banner and update the cookie policy to reflect them, and choose hosting that keeps data in the region you intend. By preserving the lean default and controlling additions, you keep the platform simple, fast and easy to explain to visitors.

Compliance

## WordPress (Core, Self Hosted) and the GDPR

- Legal basis

  Legitimate interest and contract performance under Article 6(1)(b) and (f) GDPR for strictly necessary functional cookies, which are exempt from the consent requirement of the ePrivacy Directive

- Risk level

  low

- Applicable regulations

  GDPR, ePrivacy Directive, UK GDPR and PECR

### Impact assessment (DPIA)

A data protection impact assessment is normally not needed for a plain core WordPress install because it only sets strictly necessary functional cookies for logged in users and commenters. The assessment focus shifts as soon as plugins, analytics, embeds or advertising are added, since those introduce tracking and possible third country transfers. Evaluate the full plugin stack and any external embeds rather than core WordPress alone.

### Sample text for your banner

> This site runs on WordPress and uses strictly necessary cookies to keep logged in users signed in and to remember your details when you leave a comment. These functional cookies do not require consent. If we add analytics or marketing tools we will ask for your consent separately.

Cookies and trackers

## What WordPress (Core, Self Hosted) sets and contacts

- Tracking method

  First party functional cookies set by core WordPress for login sessions, admin interface preferences and comment author details, with no built in third party analytics or advertising tracking

- Server location

  Self hosted on the server chosen by the site owner, so the location depends on the hosting provider

- Cookieless mode available

  Yes

### Cookies set (6)

| Name                            | Type       | Duration           | Purpose                                                                          |
| ------------------------------- | ---------- | ------------------ | -------------------------------------------------------------------------------- |
| wordpress\_test\_cookie         | Functional | Session            | Checks whether the visitor browser accepts cookies so the login process can work |
| wordpress\_logged\_in\_\[hash]  | Functional | Session or 14 days | Identifies that a user is logged in and keeps the authenticated session active   |
| wordpress\_sec\_\[hash]         | Functional | Session or 14 days | Secures the authenticated session within the admin area and protected pages      |
| wp-settings-\[UID]              | Functional | 1 year             | Stores personal admin and interface preferences for a logged in user             |
| comment\_author\_\[hash]        | Functional | 347 days           | Remembers the name and website of a commenter to prefill the comment form        |
| comment\_author\_email\_\[hash] | Functional | 347 days           | Remembers the email address of a commenter to prefill the comment form           |

### Third-party domains contacted (4)

- `api.wordpress.org`
- `wordpress.org`
- `secure.gravatar.com`
- `s.w.org`

Questions

## Frequently asked questions about WordPress (Core, Self Hosted)

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies does default WordPress set?

A plain WordPress install sets only first party functional cookies. The wordpress\_test\_cookie checks cookie support, wordpress\_logged\_in and wordpress\_sec keep authenticated users signed in, wp-settings stores admin preferences and the comment\_author cookies prefill the comment form. Anonymous readers who do not log in or comment usually receive no persistent cookies.

### Is consent required for core WordPress cookies?

Generally no. The core cookies are strictly necessary functional cookies that fall under the exemption in Article 5(3) of the ePrivacy Directive, so they do not require consent. Comment cookies are set only after the user actively chooses to comment and can be declined. Consent becomes necessary only when plugins or external services add non essential tracking.

### What is the legal basis for default WordPress?

The limited core processing relies on contract performance and legitimate interest under Article 6(1)(b) and (f) of the GDPR, because the cookies are needed to deliver the login and commenting functions the user requested. No consent based marketing processing happens in a default install. The basis changes if you add analytics or advertising.

### Does default WordPress transfer data to third countries?

Core WordPress does not transfer personal data to third countries on its own. Where your data lives depends entirely on the hosting provider you choose, so a European host keeps data within the European Economic Area. Third country transfers normally appear only through external services such as a content delivery network, Gravatar or analytics that you add.

### Do I need a DPIA for default WordPress?

A data protection impact assessment is normally not required for a plain core install, because it only sets strictly necessary functional cookies with low privacy impact. The need for a DPIA arises when you add plugins, profiling, analytics or advertising that introduce tracking and possible transfers. Assess the full plugin stack rather than core WordPress alone.

### How do I run default WordPress compliantly?

Document the core functional cookies in your privacy and cookie policy and state that they are strictly necessary. You do not need a consent banner for core cookies alone, but keep an inventory and update it whenever you install a plugin or embed. Choose a hosting region that suits your users and keep WordPress updated for security.

### What are alternatives to default WordPress?

Alternatives include other content management systems such as Ghost, Joomla, Drupal or static site generators, each with its own cookie behavior. For privacy minded sites a static generator sets almost no cookies, while hosted platforms may add their own tracking. The key difference is usually the plugins and external services rather than the core platform.

### How do I keep my cookie policy updated for WordPress?

Re scan your site whenever you install or update a plugin, theme or embed, because those are what usually introduce new cookies and third party requests. Keep the core functional cookies documented and add any non essential cookies that plugins bring, along with a consent banner if needed. Review the policy after every significant change to the site.

Same category

## More services: CMS

[See the whole category](https://www.flowconsent.com/en/services/cms)

### [Easy Web Editor](https://www.flowconsent.com/en/services/cms/easy-web-editor)

[Easy Web Editor is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Easy Web Editor supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Easy Web Editor enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/easy-web-editor)

[CMS](https://www.flowconsent.com/en/services/cms/easy-web-editor)

·

### [Webzie](https://www.flowconsent.com/en/services/cms/webzie)

[Webzie is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Webzie supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Webzie ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/webzie)

[CMS](https://www.flowconsent.com/en/services/cms/webzie)

·

### [Botble CMS](https://www.flowconsent.com/en/services/cms/botble-cms)

[Botble CMS is a powerful content management system (CMS) designed to help businesses and developers build, manage, and publish digital content with ease. It offers a flexible architecture that supports custom content types, templates, and workflows, making it ideal for websites of any scale. With Botble CMS, teams can streamline content creation, improve collaboration, and deliver engaging web experiences. Its extensible plugin ecosystem and API-first approach ensure seamless integration with existing.](https://www.flowconsent.com/en/services/cms/botble-cms)

[CMS](https://www.flowconsent.com/en/services/cms/botble-cms)

·

### [DSpace](https://www.flowconsent.com/en/services/cms/dspace)

[DSpace is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. DSpace integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, DSpace helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/dspace)

[CMS](https://www.flowconsent.com/en/services/cms/dspace)

·

### [Lodel](https://www.flowconsent.com/en/services/cms/lodel)

[Lodel is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Lodel supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Lodel ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/lodel)

[CMS](https://www.flowconsent.com/en/services/cms/lodel)

·

### [Modulify](https://www.flowconsent.com/en/services/cms/modulify)

[Modulify is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Modulify integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Modulify makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/cms/modulify)

[CMS](https://www.flowconsent.com/en/services/cms/modulify)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)