By platform

Acceptable Use Policy Generator for WordPress

Written for the plugin stack - because on WordPress, the plugins are the data flows.

Generate your acceptable use policy Read the acceptable use policy guide

Any WordPress site with open comments, user registration or multi-author publishing needs enforceable rules. Without them, moderating a problem user is a judgement call you cannot point at anything to justify.

WordPress core collects very little: comment author details, a login cookie, and whatever the theme adds. Everything else comes from plugins, and a typical business site runs between fifteen and forty of them. Contact forms, analytics, SEO tools, caching, backups, security, membership, e-commerce and email marketing each collect, store or transmit personal data.

That makes the plugin list the single most important input to a WordPress privacy policy. WordPress core has built-in privacy tooling - a suggested policy text assembled from plugins that implement the privacy API, plus personal data export and erase tools - but only some plugins participate, so the suggested text is always incomplete.

Self-hosting adds a layer most site owners forget: your host processes personal data too, server logs record IP addresses, and backups replicate everything including data a user has asked you to delete.

What a acceptable use policy for a WordPress site has to cover

What may not be posted in comments, submissions or author contributions
Spam, link-dropping and automated posting, with the technical measures you apply
How content is reported, and what happens after a report
The enforcement ladder from moderation queue to account removal
Copyright complaints and the takedown route, including a DMCA agent where you serve US users

How a WordPress site actually moves personal data

Contact form submissions

Contact Form 7, WPForms and Gravity Forms may email submissions, store them in the database, or both - and each has its own retention setting that defaults to keeping everything.

Comment metadata

WordPress stores the commenter’s IP address and user agent alongside the comment, which many site owners do not realise and few disclose.

Analytics and SEO plugins

Analytics plugins inject tracking, and some SEO plugins phone home with usage telemetry. Both belong in the disclosure.

Security plugins and firewall logs

Wordfence, Sucuri and similar log IP addresses and login attempts, retain them, and often send data to a vendor cloud.

Backups and staging copies

Full-database backups replicate personal data to another location, and a deletion request has to reach them or your erasure is incomplete.

Gravatar and remote avatars

Enabled by default, sending a hash of the commenter’s email address to Automattic on every page view that shows an avatar.

Third parties the draft will ask you about

Automattic (Jetpack, Gravatar) · WooCommerce · Stripe · PayPal · Mailchimp · Wordfence · Cloudflare · UpdraftPlus · Google Analytics 4 · your hosting provider

The rules that apply

WordPress privacy tools

Settings → Privacy assembles suggested policy text from participating plugins, and Tools → Export/Erase Personal Data handles subject requests for core and participating plugins.

Plugin-by-plugin obligations

Each plugin that transmits data off-site introduces a new recipient and usually a new processor agreement to obtain.

Hosting and server logs

Your host is a processor. Access logs containing IP addresses are personal data with their own retention question.

WooCommerce and payment gateways

Order, customer and payment data, with gateway plugins handing card details to the provider.

Comment and user data

Core stores comment author name, email, IP address and user agent, and sets a cookie if the consent checkbox is ticked.

What the generated acceptable use policy contains

Prohibited content and conduct
The categories you will not host, written specifically enough to enforce and narrowly enough to defend.
Technical restrictions
Rate limits, scraping, load testing, resource abuse and circumvention of quotas.
Security research boundaries
What testing is permitted, how to report a finding, and what will not be treated as an attack.
Reporting and moderation
How abuse is reported, what happens next, and the timescales you work to.
Enforcement ladder
Warning, throttle, suspension, termination - with the emergency route for genuinely urgent harm.
Appeals
How someone contests a decision, which several online-safety regimes now require rather than merely encourage.

Publishing the document on WordPress

Create the page and set it as the privacy policy page
Settings → Privacy lets you designate it, which makes core link it from the login and registration screens.
Export your plugin list first
It is the raw material for the recipients and cookies sections. Note which ones transmit data off-site.
Configure form and comment retention
Set a real period in each form plugin and decide how long comment metadata is kept.
Decide on Gravatar
Disable it, or disclose it. Discussion settings control whether avatars render at all.
Test the export and erase tools
Tools → Export Personal Data and Erase Personal Data. Confirm what they actually return, and document what they miss.
Add the policy links to the footer widget or menu
So they appear site-wide rather than only where the theme happens to place them.

Where this usually goes wrong

Publishing the suggested privacy text unedited

Settings → Privacy generates suggested content with instructional placeholders. Sites publish it verbatim, brackets included.

Undisclosed plugin data flows

Only plugins that implement the WordPress privacy API contribute to the suggested text. The others - often the ones sending the most data - are silent.

Gravatar left on without disclosure

It transmits an email hash to a third party for every avatar rendered.

Erasure requests that miss backups and caches

A deletion that leaves the record in nightly backups and a CDN cache is not a deletion.

No processor agreement with the host

Hosting is processing. The contract needs Article 28 terms if you serve UK or EU visitors.

Comment IP logging with no retention rule

Stored indefinitely by default, with no purpose after the spam check is done.

Frequently asked questions

Does WordPress generate a privacy policy for me?

It generates suggested text assembled from core and from plugins that implement the privacy API. It is a scaffold with placeholders and it is silent about every plugin that does not participate.

Do I need to list every plugin in my privacy policy?

Not every plugin, but every plugin that collects personal data or sends it somewhere. A caching plugin that stays local is different from an analytics plugin that transmits to a vendor.

Does WordPress store IP addresses?

Yes - comment author IP addresses and user agents are stored by default, and most security plugins log far more. Both are personal data.

What about my hosting provider?

They are a processor. You need appropriate contractual terms with them, and your policy should disclose hosting as a category of recipient including where the servers are.

Do I need an acceptable use policy separate from my terms?

A separate AUP is easier to enforce and easier to update. It also gives moderation staff and automated systems a single reference to cite, which matters when a suspension is challenged.

Does an AUP help with platform liability?

It is part of the picture. Intermediary liability protections generally depend on acting on notice, and both the EU Digital Services Act and the UK Online Safety Act expect published rules, a reporting route and an appeals process.

How specific should prohibited-use lists be?

Specific enough that a moderator can apply it consistently, with a residual catch-all. Lists that are only catch-alls get challenged; lists that are only specific leave gaps.