ShipPatrolScan your site for legal, security and SEO gaps, then fix them
Built with WordPress

What WordPress doesn't set up for you

WordPress runs on every kind of host with a plugin for everything. That's the strength and the problem: what your site does depends on the host, the theme and whichever plugins someone installed in 2019. Core gives you a head start on a couple of items; the rest depends on your setup.

What WordPress gives you

Privacy policy
Since 4.9.6, Settings > Privacy can create a Privacy Policy page from a template with suggested content. WordPress says it is your responsibility to fill it in and keep it accurate. Source: wordpress.org (opens in a new tab)
Sitemap
Since 5.5, core publishes a sitemap index at /wp-sitemap.xml, unless search engines are discouraged or an SEO plugin replaces it with its own. Source: make.wordpress.org (opens in a new tab)
Cookie consent
Core has no cookie banner. The WP Consent API plugin lets plugins share consent choices, but it needs a separate banner plugin to do anything. Source: wordpress.org (opens in a new tab)
Hosting and security
Security depends partly on your host. WordPress's hardening guide focuses on updates, file permissions and protecting wp-config.php. Source: developer.wordpress.org (opens in a new tab)

What WordPress already checks

The checklist

What's still on you

  1. Plugins that track before consent

    Analytics, pixel and embed plugins usually add their scripts to every page. A cookie banner plugin only holds them back if it's set up to, and if the plugins understand each other, which is what the WP Consent API is for.

    Patch checks:Critical Trackers load before consentHigh No cookie banner

  2. The privacy policy template, never finished

    The core template is a starting point with suggestions, and WordPress is clear that keeping it accurate is on you. Every plugin added since (forms, newsletters, analytics, a chat widget) may need a line in it.

    Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses

  3. Security headers

    WordPress's hardening guide doesn't cover response headers. They usually come from your host, your server config or a plugin, so they vary from one site to the next. Check what your site actually sends.

    Patch checks:Medium No Content-Security-Policy header

  4. Files left in the web root

    Migrations, backups and deploy scripts can leave things like a .env file or a .git folder where the web server will hand them to anyone who asks. ShipPatrol only checks for these after you verify you own the site.

    Patch checks:Critical Configuration files can be downloaded

  5. Descriptions, link previews and the right sitemap

    Meta descriptions and Open Graph tags usually come from your theme or an SEO plugin, so check every important page has them. If a plugin replaced the core sitemap, make sure robots.txt and Search Console point at the one that exists.

    Patch checks:Medium Pages with missing or duplicate titlesMedium No sitemap.xml

  6. Alt text, contrast and form labels

    These depend on the theme, the editor and whoever uploads the images. Media libraries fill up fast, and form plugins vary in how they label fields.

    Patch checks:Medium Images without alt textMedium Text contrast too lowMedium Form fields without labels

  7. An Impressum, if you need one

    Businesses in Germany and Austria generally need a legal notice with specific details. WordPress has a privacy page helper but nothing for this, so it is a page you write and link from every page.

    Patch checks:Medium No Impressum

  8. Renewal wording on subscriptions and memberships

    If a plugin sells subscriptions or memberships, the sign-up page needs to say what renews, when, for how much, and how to cancel. The plugin handles billing; the wording is yours.

    Patch checks:High Subscription sold without clear renewal and cancellation terms

What ShipPatrol adds

  • Loads your site from the UK, EU and US, accepts and rejects the cookie banner, and records which plugin scripts fire before and after.
  • Compares your privacy policy with the services the site actually loads, including the ones a plugin added without asking.
  • Re-scans daily or from a deploy hook and emails you when a plugin update changes something.

ShipPatrol isn't affiliated with WordPress. Product names belong to their owners. Facts about WordPress were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.

Free scan

Scan your WordPress site.

Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.

No signup needed. Not legal advice; every check names its source.

Sources