GDPR check for WordPress

WordPress itself is uncritical — the data-protection issues almost always come via themes, plugins and embedded content.

Is this a risk?

Common sources: themes that load Google Fonts from Google; analytics or marketing plugins without consent logic; embedded YouTube/Maps blocks; emojis and Gravatars from external servers. For all non-necessary access, § 25 (1) TDDDG applies.

What you can do

• Localise Google Fonts (e.g. plugin “OMGF”), disable external emoji scripts.
• Load analytics/marketing only via a consent plugin that blocks tags until agreement.
• Switch YouTube/Maps blocks to two-click embedding.
• After every plugin installation, check the source code of the home page.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.