Cookie banners aren’t enough. Many WordPress sites quietly send personal data to third parties before visitors ever click “accept.” That’s not just a user-trust issue. Under GDPR, it can mean non-compliance and potential fines.
Real compliance (and real privacy) comes from controlling those data flows at the source. This guide shows you how to audit your site, close common leaks, and apply WordPress-specific fixes that respect both the law and your visitors.
⚖️ Disclaimer
This guide provides general, practical information based on regulatory trends as of September 2025. GDPR requirements vary by country and context. This isn’t legal advice. If compliance is business-critical, talk to a data protection professional.
TL;DR (individuals / small sites)
- Fix Google Fonts → Switch to system fonts or Bunny Fonts to stop IP leaks. (~5 minutes)
- Replace Google Analytics → Use Plausible or Simple Analytics for privacy-first tracking. (~10 minutes)
- Audit Plugins → Remove or replace plugins that send data to US-based services (reCAPTCHA, Google Maps, Mailchimp). (~15–30 minutes)
👉 These quick wins remove the most common GDPR risks from WordPress sites with less than an hour’s work.
TL;DR (Companies)
- Document Data Flows → Keep a simple record of which plugins and services process visitor data, and where they store it. (~30–60 minutes)
- Set Security & Privacy Headers → Add Referrer-Policy, HSTS, and Permissions-Policy. (~15 minutes with a plugin)
- Review Hosting & Email Providers → Prefer EU/EFTA-headquartered services with strong DPAs. (~1–2 hours to assess options)
👉 These steps won’t replace a full GDPR program, but they create an audit trail and reduce compliance risks for growing teams.
Jump to WordPress Setup:
Fonts Fix | Analytics Setup | Plugin Audit | EU Hosting | Headers | Troubleshooting
Before You Start: Audit Your Site
Don’t change anything until you know what’s already happening. Most site owners are surprised by what turns up.
Free tools you can use today:
- Blacklight – detects trackers, ads, and session replay scripts
- BuiltWith – lists third-party services and plugins in use
- Snyk Website Scanner – checks for vulnerabilities in site code and dependencies
- Security Headers – quick check for privacy/security headers
- Mozilla Observatory – deeper header and TLS analysis
- Webbkoll – privacy checks from the Swedish Data Protection Foundation
- Browser DevTools → Network tab – see all live requests as your site loads
👉 At minimum, run Blacklight and DevTools. Small businesses and companies should add Snyk or Observatory to their regular checks.
Step 1: Fonts – The Silent Data Leak
Many WordPress themes load fonts directly from Google Fonts. Each request transmits visitor IP addresses and browser details to Google. Under GDPR, an IP address counts as personal data. In January 2022, the Munich Regional Court ruled that loading Google Fonts from Google’s servers without consent was unlawful. The site operator was fined and warned of steep penalties for ongoing violations.
Ways to fix it
- Simplest (personal sites/blogs): Switch to system fonts (Arial, Helvetica, sans-serif). No external calls, no configuration.
- Balanced (small businesses/design-focused): Use OMGF to host Google Fonts locally on your own server.
- Scalable (larger orgs/brands): Use Bunny Fonts – an EU-hosted (Slovenia), open-source replacement that doesn’t log visitor IPs and was built specifically as a GDPR-compliant alternative.
👉 Best practice: avoid loading fonts from Google servers. Pick the option that matches your site’s scale and design needs.
WordPress Font Fix {#wp-fonts}
Method 1: Quick URL Swap (2 minutes)
- Backup first! (Use UpdraftPlus plugin or hosting backup)
- Go to Appearance → Theme Editor
- Search files for
fonts.googleapis.com - Replace with
fonts.bunny.net - Save changes
Method 2: Plugin (Easier)
- Install OMGF from Plugins → Add New
- Go to Settings → Optimize Google Fonts
- Click “Auto-Detect & Replace”
- Save and clear cache
Method 3: System Fonts
- Appearance → Customize → Typography
- Change font family to “System Default”
- (Location may vary by theme)
Step 2: Plugins, Forms and Embeds
Plugins extend WordPress, but many quietly send personal data to third parties. Even if you’ve fixed fonts, your plugins might still be leaking data.
WordPress Plugin Audit {#wp-plugins}
Go to Plugins → Installed Plugins and check:
- Contact forms – Using reCAPTCHA? Switch to honeypot protection
- Map plugins – Google Maps API? Replace with Leaflet
- Social sharing – External scripts? Use static icons or Shariff
- Newsletter plugins – US providers like Mailchimp? Consider EU alternatives
- Chat widgets – Check provider location and privacy policy
👉 To review: open each plugin’s settings → look for “external services,” “API keys,” or “third-party.” Then check if they mention where data is processed.
Why It Matters
Common culprits include:
- Google reCAPTCHA (form submissions, user data → Google)
- Maps plugins using Google Maps (IP addresses → Google)
- Social sharing buttons with tracking scripts
- Newsletter plugins tied directly to Mailchimp or SendGrid (US-based)
- Live chat widgets from US providers like Intercom
Each one creates external data flows, often before you’ve even added a cookie banner.
EU-Friendly Alternatives
- Forms: Contact Form 7 with honeypot spam protection
- Maps: Leaflet with OpenStreetMap
- Social sharing: Static icon links or Shariff Wrapper for privacy-friendly sharing
- Newsletters: Sendy (self-hosted, Amazon SES optional) or Mailcoach
- Live chat: Crisp (France), Userlike (Germany)
⚠️ Every plugin adds dependency risk. Even if today’s version is compliant, updates or new owners can change data practices. Re-audit regularly.
Step 3: Analytics Without the Banner Burden
Google Analytics is one of the most common GDPR pitfalls. It sets cookies and transfers visitor data to Google. Starting in 2022, regulators in Austria and France ruled that its use without safeguards was unlawful. Since then, authorities in Italy, Denmark, Finland, Norway, and Sweden have taken similar positions.
Why It Matters
If you’re using Google Analytics, you usually need a cookie consent banner. Even then, enforcement is patchy and risky, because visitor data still flows to the US. Many site owners end up with banners that annoy users but don’t fully solve compliance.
Privacy-First Alternatives
- Plausible – EU-hosted (Estonia), data stored in Germany, no cookies. Independently assessed by data protection lawyers.
- Umami – open source, self-hosted, full control over your analytics data.
- Simple Analytics – Netherlands-based SaaS, lightweight, privacy-first.
👉 For individuals or small businesses, Plausible or Simple Analytics is the fastest swap. Larger companies may prefer self-hosting Umami to avoid vendor lock-in.
Quick Win
Replacing Google Analytics with Plausible typically takes under 15 minutes. You’ll remove the need for a cookie banner and gain GDPR-compliant insights with almost no disruption.
WordPress Analytics Setup {#wp-analytics}
Replace Google Analytics (10 minutes):
- Remove old GA code first:
- Appearance → Theme Editor → header.php
- Delete Google Analytics script
- Or deactivate GA plugin
- Add new analytics:
- Sign up: Plausible (€9/month) or Simple Analytics (€19/month)
- Copy provided tracking script
- Option A: Paste in header.php before
</head> - Option B: Install Insert Headers & Footers → paste in “Header” section
- Verify it works:
- Visit your site
- Check analytics dashboard for real-time data
| Service | Location | Monthly Cost | Setup Time |
|---|---|---|---|
| Service | Location | Monthly Cost | Setup Time |
| Plausible | 🇪🇪 Estonia | €9 | 5 mins |
| Simple Analytics | 🇳🇱 Netherlands | €19 | 5 mins |
| Umami (self-hosted) | Your server | Free | 30+ mins |
Note: Enforcement differs by country. Check your national DPA’s latest stance before deciding what’s safe.
Step 4: Hosting, Email and Data Residency
Your host and email provider matter just as much as your WordPress setup. Data protection isn’t just about plugins, it’s also about where your data physically lives and which laws apply.
Why It Matters
Many US companies advertise “EU servers,” but that doesn’t mean EU jurisdiction. Under laws like the US CLOUD Act, data stored in Europe by US providers can still be accessed by US authorities. Using EU/EFTA-headquartered providers gives you stronger legal safeguards, clearer DPAs, and greater control over where your data is processed.
Hosting – EU/EFTA Headquartered Examples
- Hetzner (Germany) — widely trusted, also used by privacy-focused services like Plausible
- OVHcloud (France) — major European cloud provider with broad infrastructure
- Infomaniak (Switzerland) — transparent policies, strong sustainability focus
- Netcup (Germany) — cost-effective hosting with GDPR documentation
- Uberspace (Germany) — simple, flexible shared hosting, privacy by design
Email – EU Providers for Transactional and Business Mail
- Proton Mail Business (Switzerland) — zero-access encryption, GDPR-aligned
- Tutanota (Germany) — lightweight, end-to-end encrypted alternative to Google Workspace
- mailbox.org (Germany) — Outlook-compatible, strong compliance docs
- Infomaniak Mail (Switzerland) — integrates well with Infomaniak hosting
Quick Win
If your site is already on a mainstream EU host like Hetzner or OVHcloud, you’re in a good position. Document that choice and their DPA. If you’re still hosted in the US, migrating to an EU provider is one of the highest-impact compliance moves you can make.
WordPress Hosting Migration {#wp-hosting}
Before Switching Hosts:
- Backup full site (files + database)
- Export WordPress content (Tools → Export)
- List plugins & themes
- Document custom settings
Migration Process:
- Sign up with your new EU host (Hetzner, OVHcloud, etc.)
- Install WordPress (most hosts offer 1-click installs)
- Restore your site from backup or use a migration plugin
- Update DNS once the site works perfectly
- Test email functionality
- Cancel old hosting (after DNS propagation)
Helpful Migration Plugins:
- All-in-One WP Migration
- Duplicator
- UpdraftPlus (backup & restore)
Step 5: Security and Privacy Headers
Headers aren’t visible to visitors, but they shape how browsers handle your site. Correctly set headers improve both compliance and security.
Why It Matters
Without the right headers, your site may leak more data than you realize. For example, sending full URLs as referrers, or leaving features like camera/microphone access available to any script. Regulators increasingly view missing headers as poor privacy hygiene.
Headers Worth Setting
- Referrer-Policy – limit URL data sent when users click links
- Strict-Transport-Security (HSTS) – enforce HTTPS for all connections
- Permissions-Policy – disable unneeded browser features (camera, mic, geolocation)
- Content-Security-Policy (CSP) – whitelist trusted domains for scripts and assets
👉 For individuals: at least Referrer-Policy and HSTS.
👉 For companies: add Permissions-Policy and a tailored CSP.
Quick Win
Adding just Referrer-Policy and HSTS takes under 10 minutes with a plugin. These two alone prevent the most common privacy leaks and give you an immediate bump in Security Headers test scores.
WordPress Headers Setup {#wp-headers}
Method 1: Plugin (Easiest)
Method 1: Plugin (Easiest)
- Install HTTP Headers plugin
- Go to Settings → HTTP Headers
- Add these headers:
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000
Permissions-Policy: camera=(), microphone=(), geolocation=() Method 2: .htaccess (Advanced)
In your WordPress root .htaccess file, add:
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"Test Your Headers:
- Visit Security Headers
- Enter your domain
- Shoot for a B+ or better, it shows you’ve covered the basics
Step 6: Ongoing Hygiene
GDPR compliance isn’t a one-time project. New plugins, theme updates, or embeds can reintroduce data flows overnight. And regulatory interpretations continue to evolve — what passes today might fail tomorrow.
Why It Matters
Think of this as site hygiene: just like updates and backups, privacy checks should be part of routine WordPress maintenance. Documenting what you do also helps if a regulator or customer ever asks.
Maintenance Plan
Monthly
- Update all plugins and themes
- Re-scan site with Blacklight
- Check plugin changelogs for new data-sharing features
- Re-test fonts and analytics after updates
Quarterly
- Run deeper scans with Webbkoll or Mozilla Observatory
- Review your plugin inventory → remove anything unused
- Confirm analytics, fonts, and headers are still configured correctly
Yearly
- Review all Data Processing Agreements (DPAs) with hosting, email, and analytics providers
- Update your records of where data flows (even simple notes are valuable)
- Re-check national DPA guidance since enforcement priorities shift by country
WordPress-Specific Tip
Always test big changes in a staging environment before going live. This catches issues with fonts, analytics, or headers before they affect visitors.
Final Thoughts
GDPR compliance for WordPress isn’t about banners. It’s about practical design choices: where data goes, and who can access it.
For Individuals & Small Businesses
Focus on the quick wins:
- Swap Google Fonts for system fonts or Bunny Fonts
- Replace Google Analytics with a privacy-first alternative
- Audit your top plugins for hidden data flows
These steps take less than an hour but eliminate the most common GDPR issues. You’ll respect your visitors’ privacy and avoid unnecessary legal risk.
For Companies & Teams
Compliance requires structure:
- Keep a plugin/service inventory with data locations
- Document DPAs with hosts, email providers, and analytics vendors
- Apply stricter headers (Referrer-Policy, HSTS, Permissions-Policy, CSP)
- Run quarterly privacy scans and test changes in staging
This won’t make you bulletproof, but it shows diligence, cuts risk, and gives you an audit trail if anyone ever asks.
Remember: This guide reflects best practices as of September 2025. GDPR enforcement evolves, and different EU member states may take different positions. Always check your national DPA’s latest guidance. Contact a qualified professional for business-critical implementations.
Legal Developments to Watch
- Digital Services Act: new obligations on transparency and platform responsibilities
- Data transfer adequacy decisions: changes could affect EU↔US or EU↔third-country flows
- National DPA enforcement priorities: member states differ in how aggressively they enforce GDPR
Staying ahead of these trends means fewer surprises, and a site that’s built to last.