By platform

Terms & Conditions Generator for WordPress

Written for the plugin stack - because on WordPress, the plugins are the data flows.

Generate your terms and conditions Read the terms and conditions guide

WordPress sites span blogs, membership sites, shops and directories, so the terms document has to match what the site actually does. The clauses that matter most are usually about user-submitted content, because comments and uploads are where disputes start.

WordPress core collects very little: comment author details, a login cookie, and whatever the theme adds. Everything else comes from plugins, and a typical business site runs between fifteen and forty of them. Contact forms, analytics, SEO tools, caching, backups, security, membership, e-commerce and email marketing each collect, store or transmit personal data.

That makes the plugin list the single most important input to a WordPress privacy policy. WordPress core has built-in privacy tooling - a suggested policy text assembled from plugins that implement the privacy API, plus personal data export and erase tools - but only some plugins participate, so the suggested text is always incomplete.

Self-hosting adds a layer most site owners forget: your host processes personal data too, server logs record IP addresses, and backups replicate everything including data a user has asked you to delete.

What a terms and conditions for a WordPress site has to cover

Rules for comments and user submissions, with moderation and removal rights
Membership or subscription terms where a membership plugin is in use
Content licensing: what you may do with what users post
Copyright complaint handling, including a DMCA route where you serve US users

How a WordPress site actually moves personal data

Contact form submissions

Contact Form 7, WPForms and Gravity Forms may email submissions, store them in the database, or both - and each has its own retention setting that defaults to keeping everything.

Comment metadata

WordPress stores the commenter’s IP address and user agent alongside the comment, which many site owners do not realise and few disclose.

Analytics and SEO plugins

Analytics plugins inject tracking, and some SEO plugins phone home with usage telemetry. Both belong in the disclosure.

Security plugins and firewall logs

Wordfence, Sucuri and similar log IP addresses and login attempts, retain them, and often send data to a vendor cloud.

Backups and staging copies

Full-database backups replicate personal data to another location, and a deletion request has to reach them or your erasure is incomplete.

Gravatar and remote avatars

Enabled by default, sending a hash of the commenter’s email address to Automattic on every page view that shows an avatar.

Third parties the draft will ask you about

Automattic (Jetpack, Gravatar) · WooCommerce · Stripe · PayPal · Mailchimp · Wordfence · Cloudflare · UpdraftPlus · Google Analytics 4 · your hosting provider

The rules that apply

WordPress privacy tools

Settings → Privacy assembles suggested policy text from participating plugins, and Tools → Export/Erase Personal Data handles subject requests for core and participating plugins.

Plugin-by-plugin obligations

Each plugin that transmits data off-site introduces a new recipient and usually a new processor agreement to obtain.

Hosting and server logs

Your host is a processor. Access logs containing IP addresses are personal data with their own retention question.

WooCommerce and payment gateways

Order, customer and payment data, with gateway plugins handing card details to the provider.

Comment and user data

Core stores comment author name, email, IP address and user agent, and sets a cookie if the consent checkbox is ticked.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Publishing the document on WordPress

Create the page and set it as the privacy policy page
Settings → Privacy lets you designate it, which makes core link it from the login and registration screens.
Export your plugin list first
It is the raw material for the recipients and cookies sections. Note which ones transmit data off-site.
Configure form and comment retention
Set a real period in each form plugin and decide how long comment metadata is kept.
Decide on Gravatar
Disable it, or disclose it. Discussion settings control whether avatars render at all.
Test the export and erase tools
Tools → Export Personal Data and Erase Personal Data. Confirm what they actually return, and document what they miss.
Add the policy links to the footer widget or menu
So they appear site-wide rather than only where the theme happens to place them.

Where this usually goes wrong

Publishing the suggested privacy text unedited

Settings → Privacy generates suggested content with instructional placeholders. Sites publish it verbatim, brackets included.

Undisclosed plugin data flows

Only plugins that implement the WordPress privacy API contribute to the suggested text. The others - often the ones sending the most data - are silent.

Gravatar left on without disclosure

It transmits an email hash to a third party for every avatar rendered.

Erasure requests that miss backups and caches

A deletion that leaves the record in nightly backups and a CDN cache is not a deletion.

No processor agreement with the host

Hosting is processing. The contract needs Article 28 terms if you serve UK or EU visitors.

Comment IP logging with no retention rule

Stored indefinitely by default, with no purpose after the spam check is done.

Frequently asked questions

Does WordPress generate a privacy policy for me?

It generates suggested text assembled from core and from plugins that implement the privacy API. It is a scaffold with placeholders and it is silent about every plugin that does not participate.

Do I need to list every plugin in my privacy policy?

Not every plugin, but every plugin that collects personal data or sends it somewhere. A caching plugin that stays local is different from an analytics plugin that transmits to a vendor.

Does WordPress store IP addresses?

Yes - comment author IP addresses and user agents are stored by default, and most security plugins log far more. Both are personal data.

What about my hosting provider?

They are a processor. You need appropriate contractual terms with them, and your policy should disclose hosting as a category of recipient including where the servers are.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.