Don't Send Guest Commenters' Emails to Gravatar
Shows a built-in placeholder avatar for comments from visitors without an account, so their hashed email address is never sent to Gravatar, while registered users keep their Gravatar picture.
Snippet Library
Privacy & Cookies snippets for WordPress
Snippets for privacy and cookies: load tracking only after consent, remove IP addresses, tidy personal data and add privacy notices. For site owners working toward GDPR and similar privacy rules.
Don't Send Referrer Information to Other Sites
Adds rel="noreferrer" to links in your content that point to other websites, so the sites you link to do not learn which page the visitor came from.
Don't Store Commenters' Browser Details
Stops WordPress from saving each commenter's browser user agent string with their comment, which is rarely needed and counts as personal data.
Expire Personal Data Export Downloads After 24 Hours
Shortens how long the download link and ZIP file of a personal data export stay available, from WordPress's default of three days to one day.
Hide Commenter Email Addresses From Authors and Contributors
Hides commenters' email addresses in the comment lists of the dashboard for users who are not moderators, so authors can reply to comments without seeing readers' personal email addresses.
Hide Commenter IP Addresses From Non-Administrators
Hides commenters' IP addresses in the Comments screens for editors, moderators and authors, so only administrators can see this personal data.
Load Social Media Post Embeds Only on Click
Holds back embedded posts from X (Twitter), Instagram, Facebook, TikTok and Threads behind a short notice, so their scripts and trackers only load when the visitor asks for them.
Load Vimeo Videos Only After a Click
Replaces embedded Vimeo players with a lightweight placeholder showing the video title, so nothing is loaded from Vimeo until the visitor clicks to play.
Never Send the Referrer From Checkout and Account Pages
Sends a strict no-referrer policy on the WooCommerce checkout, order received and account pages, so order keys and other private URL details are never passed to third-party scripts or sites linked from there.
Remember Commenters' Details for 30 Days Instead of a Year
Shortens how long the cookies that remember a commenter's name, email and website last, from WordPress's default of one year to 30 days.
Remove Ad Click IDs From Links in Your Content
Strips tracking parameters such as fbclid, gclid, msclkid and Mailchimp or HubSpot IDs from links in your posts (often pasted in by accident), so you do not pass your visitors' ad tracking along to other sites.
Remove Completed Privacy Requests After 90 Days
Deletes finished export and erasure requests (and failed ones) from Tools > Export/Erase Personal Data once they are 90 days old, since the request records themselves contain email addresses.
Remove IP Addresses From Comment Notification Emails
Strips commenters' IP addresses and host names from the new comment and moderation emails WordPress sends to authors and administrators, so personal data does not pile up in inboxes.
Remove Location and Camera Data From Uploaded Photos
Strips EXIF metadata such as GPS location, camera serial number and date from JPEG and WebP images when they are uploaded, while keeping them correctly rotated.
Self-Host Google Fonts Used by Your Theme and Plugins
Detects Google Fonts stylesheets loaded on your site, lets you download them to your own server from Tools > Local Google Fonts, and then serves the local copies so visitors' browsers never contact Google.
Stop Dashboard Browser and PHP Version Lookups
Prevents the dashboard from sending your browser's user agent and your server's PHP version to WordPress.org to decide whether to show upgrade warnings.
Third-Party Requests Inspector in the Admin Bar
Adds an admin bar item on the front of the site that counts the external domains the current page loads files from, and lists them on click, to help you keep your cookie notice and privacy policy accurate.
Turn Off WooCommerce Customer Geolocation
Stops WooCommerce from looking up each visitor's location from their IP address and uses your store's base country as the default customer location instead.
Two-Click Loading for Spotify, SoundCloud and Other Embeds
Replaces iframes from third-party services in your posts with a notice and a "Load" button, with an option to always allow that service on the visitor's device.
Vimeo Embeds With "Do Not Track"
Adds Vimeo's dnt=1 setting to every embedded Vimeo video, which stops Vimeo from setting tracking cookies or collecting session data for your visitors.