> WP Engine and GDPR: European data centres, US transfers under SCCs, customer portal cookies, the Data Processing Addendum and lawful WordPress hosting. > > Canonical: https://www.flowconsent.com/en/services/hosting/wp-engine Hosting # WP Engine Unclassified · [Official website](https://wpengine.com) WP Engine is a managed WordPress and headless WordPress hosting platform headquartered in Austin, Texas, powering over 1.5 million websites worldwide. It runs on Google Cloud Platform and offers EU data centres in Frankfurt and London. WP Engine signs a Data Processing Addendum with customers and supports Standard Contractual Clauses for transfers outside the EEA. [Block WP Engine until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Unclassified - Prior consent Not required - Documented cookies 4 - Third-party domains 5 - Servers United States (default) with EU regions in Frankfurt (europe-west3) and London (europe-west2) via Google Cloud Platform Overview ## What does WP Engine do? ## **What is WP Engine** WP Engine is a managed WordPress and headless WordPress hosting platform founded in 2010 and headquartered in Austin, Texas. It powers more than 1.5 million websites globally, running on Google Cloud Platform with data centres in multiple regions including the United States, Frankfurt and London. For European customers, WP Engine offers a Data Processing Addendum, Standard Contractual Clauses and the ability to select EU only hosting regions. ## **Data and cookies collected** At the infrastructure level, WP Engine processes server logs, visitor IP addresses, request headers and bandwidth usage. The hosting itself does not inject tracking cookies into visitor browsers. However, the WP Engine customer portal (my.wpengine.com) and marketing site (wpengine.com) set first party cookies for authentication, session management and analytics. Optional features such as Global Edge Security route visitor traffic through Cloudflare, which may set its own security cookies including \_\_cf\_bm and cf\_clearance. ## **GDPR and ePrivacy implications** WP Engine acts as a data processor under Article 28 GDPR. Customer site owners remain controllers for visitor data. WP Engine publishes a Data Processing Addendum, a list of sub processors and Standard Contractual Clauses. The ePrivacy Directive does not require consent for the hosting infrastructure itself because it does not store information on the visitor device. However, any plug ins, analytics or marketing tools running on top of WordPress remain subject to consent rules. ## **Consent requirements** No visitor consent is required for the WP Engine hosting layer itself, since it does not place cookies on visitor browsers. Consent is required for any third party tools installed on top of WordPress, such as Google Analytics, Meta Pixel or marketing tags. If Global Edge Security via Cloudflare is enabled, the security challenge cookies generally fall under the strictly necessary exemption of Art. 5(3) ePrivacy. ## **Data transfers outside the EEA** WP Engine is a US company and its support, billing and administrative functions are based in the United States. Visitor data hosted on customer sites stays in the chosen region, so European customers can keep visitor data inside the EEA by selecting Frankfurt or London. Support access from US staff and certain global services still constitute transfers to a third country and rely on Standard Contractual Clauses and the EU US Data Privacy Framework when the recipient entity is certified. ## **Practical compliance steps** Sign the WP Engine Data Processing Addendum from the customer portal, choose a European data centre region during provisioning, document the list of sub processors in your Record of Processing Activities, run a Transfer Impact Assessment if any function involves US based staff, configure Global Edge Security carefully and disclose Cloudflare as a sub processor in your privacy policy, and review WP Engine's published sub processor list at least annually for changes. Compliance ## WP Engine and the GDPR - Legal basis Contract (Art. 6(1)(b) GDPR) for hosting services; Legitimate interest (Art. 6(1)(f) GDPR) for security logging and DDoS protection - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA, EU US Data Privacy Framework ### Impact assessment (DPIA) WP Engine acts as a data processor under Art. 28 GDPR for customer site data. Key DPIA considerations: (1) server region choice, selecting US data centres triggers a third country transfer requiring a Transfer Impact Assessment; (2) access by US based support staff may constitute onward transfer subject to the same safeguards; (3) backups are retained across regions, verify retention and deletion policies; (4) server logs include visitor IP addresses processed under legitimate interest for security purposes; (5) Global Edge Security and DDoS protection use Cloudflare as a sub processor, adding an additional data flow that must be mapped; (6) the customer portal and the wpengine.com marketing site set their own cookies, separate from hosted customer sites. ### Sample text for your banner > Our website is hosted by WP Engine, a managed WordPress hosting provider. WP Engine processes connection logs, IP addresses and security data on our behalf to deliver the site. We have signed a Data Processing Addendum with WP Engine and rely on Standard Contractual Clauses for any transfers outside the EEA. Cookies and trackers ## What WP Engine sets and contacts - Tracking method Managed WordPress hosting infrastructure (Google Cloud Platform); first-party cookies on customer portal and marketing site only - Server location United States (default) with EU regions in Frankfurt (europe-west3) and London (europe-west2) via Google Cloud Platform - Cookieless mode available Yes - Data transferred outside the EU By default, WP Engine hosts customer sites on Google Cloud Platform US data centres. EU customers can select Frankfurt or London regions to keep visitor data inside the EEA. Transfers to the United States rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and the EU US Data Privacy Framework where applicable. WP Engine also processes support and billing data via US based teams. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------- | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | wpe-auth | Functional | Session | Used on the WP Engine customer portal (my.wpengine.com) to maintain an authenticated session for customers. | | \_wpe\_aff | Marketing | 30 days | Stores the WP Engine affiliate referrer on the marketing site wpengine.com to attribute new sign ups to a partner. | | \_\_cf\_bm | Functional | 30 minutes | Cloudflare bot management cookie set in front of WP Engine sites when Global Edge Security is enabled. Used to distinguish humans from automated traffic. | | cf\_clearance | Functional | 30 days | Cloudflare cookie indicating that the visitor has passed a security challenge. Set when Global Edge Security is enabled. | ### Third-party domains contacted (5) - `wpengine.com` - `my.wpengine.com` - `wpenginepowered.com` - `wpengine.io` - `wpecdn.com` Questions ## Frequently asked questions about WP Engine Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does WP Engine set cookies on visitor browsers? No, the WP Engine hosting infrastructure itself does not place cookies on visitor browsers. Cookies appear only on the WP Engine customer portal (my.wpengine.com) and the marketing site (wpengine.com), where they are used for authentication, session management and analytics. If you enable the optional Global Edge Security feature, Cloudflare may set strictly necessary security cookies (\_\_cf\_bm, cf\_clearance) in front of your site. ### Do I need user consent to use WP Engine hosting? No, you do not need consent for the WP Engine hosting layer itself because it does not store information on the visitor device. Consent is, however, required for any third party tools you install on top of WordPress, such as Google Analytics, Meta Pixel or marketing scripts. Disclose WP Engine as a sub processor in your privacy policy without a consent prompt. ### What is the legal basis for processing visitor data via WP Engine? The processing relies on contract performance (Art. 6(1)(b) GDPR) between you and your visitor for delivering the website, and on legitimate interest (Art. 6(1)(f) GDPR) for security logging, DDoS protection and abuse prevention. WP Engine itself acts as a data processor under Art. 28 GDPR through the Data Processing Addendum you sign with them. ### Where does WP Engine store data, and are there transfers to the US? By default, customer sites are hosted on Google Cloud Platform infrastructure in the United States. You can choose EU regions in Frankfurt (europe-west3) or London (europe-west2) at provisioning. Even with an EU region, US based support staff and certain global services access data, which constitutes a transfer to a third country covered by Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. ### Is a DPIA required for using WP Engine? A DPIA is not strictly mandatory for hosting alone, but it is strongly recommended when you process special category data, run a high traffic site, or use the US data centre. The key risks to document are third country transfers, sub processor access (including Cloudflare for Global Edge Security), and the retention of server logs containing visitor IP addresses. ### How do I deploy WP Engine in a GDPR compliant way? Sign the WP Engine Data Processing Addendum in the customer portal, select an EU data centre during provisioning, document WP Engine and Cloudflare in your sub processor list, run a Transfer Impact Assessment if US staff access is in scope, configure WordPress to avoid unnecessary cookies, and review WP Engine's sub processor list at least once a year. ### What are GDPR friendly alternatives to WP Engine? EU based managed WordPress hosts include Kinsta (which also offers EU regions on GCP), Raidboxes (Germany), Savvii (Netherlands), 20i (UK), Pressidium (UK) and Hetzner with managed WordPress add ons. Choosing an EU controller and EU data centre simplifies your compliance posture by removing the third country transfer question. ### How should I update my cookie and privacy policy to mention WP Engine? Add WP Engine as a hosting sub processor in your privacy policy, name the data centre region you selected, mention any cookies on the WP Engine customer portal if you let visitors access it, and disclose Cloudflare if Global Edge Security is enabled. Include a link to WP Engine's sub processor list and Data Processing Addendum. If you choose a US region, document your Transfer Impact Assessment and reference the Standard Contractual Clauses. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Helhost](https://www.flowconsent.com/en/services/hosting/helhost) [Helhost is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Helhost offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Helhost empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/helhost) [Hosting](https://www.flowconsent.com/en/services/hosting/helhost) · ### [Hostens](https://www.flowconsent.com/en/services/hosting/hostens) [Hostens is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hostens offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hostens empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/hostens) [Hosting](https://www.flowconsent.com/en/services/hosting/hostens) · ### [Blade](https://www.flowconsent.com/en/services/hosting/blade) [Blade is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Blade integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Blade helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/blade) [Hosting](https://www.flowconsent.com/en/services/hosting/blade) · ### [mod\_auth\_pam](https://www.flowconsent.com/en/services/hosting/mod-auth-pam) [mod\_auth\_pam is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. mod\_auth\_pam supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, mod\_auth\_pam ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/mod-auth-pam) [Hosting](https://www.flowconsent.com/en/services/hosting/mod-auth-pam) · ### [Surge](https://www.flowconsent.com/en/services/hosting/surge) [Surge is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Surge supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Surge ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/surge) [Hosting](https://www.flowconsent.com/en/services/hosting/surge) · ### [Cloudflare Workers](https://www.flowconsent.com/en/services/hosting/cloudflare-workers) [Cloudflare Workers is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Cloudflare Workers integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Cloudflare Workers helps organizations maintain robust websites that meet user expectations.](https://www.flowconsent.com/en/services/hosting/cloudflare-workers) [Hosting](https://www.flowconsent.com/en/services/hosting/cloudflare-workers) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)