WordPress privacy policy page: why yours may still be a draft

Is your WordPress privacy policy page published?

Maybe not. Every fresh install creates a WordPress privacy policy page for you, and then leaves it in Draft.

We checked this on Sunday 11 Oct 2026 on a new WordPress 7.1.2 test site. Under Pages there was one called Privacy Policy. Its status was Draft. Nobody had touched it, and WordPress had already set it as the site’s policy page.

A draft policy page is one of the small things we look for on a site in our WordPress care plan. It takes a minute to check.

What was in the draft?

The page held 616 words under nine headings, starting with “Who we are” and ending with “Where your data is sent”.

Nine blocks were labelled Suggested text: notes for the owner to edit and remove, not for visitors.

Does WordPress show a privacy link while the page is a draft?

No, and this surprised us in the lab.

WordPress has a function called get_privacy_policy_url(). Themes use it, directly or through a helper, to print the privacy link in a footer. On our test site it returned an empty string. So did get_the_privacy_policy_link(), the version that returns a ready-made link.

The developer reference shows why. The function reads the page ID from the wp_page_for_privacy_policy setting, then checks that the page status is publish. If it is not, the URL stays empty.

So a site can have a privacy page selected and saved, and still show no link. The reference also lists the WordPress login screen footer as a place that uses the link function. We did not test the login screen ourselves.

Where do you check it?

Settings > Privacy. The WordPress documentation describes two buttons there. Create New Page builds a fresh template page. Use This Page picks an existing page from a dropdown.

Whichever page is selected is your policy as far as WordPress is concerned. Open it and look at its status. If it says Draft, visitors cannot see it, and your theme has no link to give them.

Can you publish the template as it is?

You can, but read it first. The template covers what WordPress itself handles: comments, media and cookies, among others.

It cannot know what you added after launch. A contact form plugin, an analytics script, a booking widget or a newsletter signup each handles visitor data in its own way, and none of them appears in WordPress’s template unless someone writes it in.

The Settings Privacy documentation is plain about who owns this. Keeping the policy right is, in its words, “your responsibility”, and so is keeping it “current and accurate”.

The wider WordPress Privacy page says the same in other words: the built-in tools “can help you with parts of that process, but they are not a compliance process” in themselves.

What should the policy say?

That is not ours to answer. What a policy must contain is a question for whoever advises you on law.

What anyone can check today is narrower: does the page exist, is it published, does it show, and does it name the tools your site actually runs.

How do you fix a draft privacy page?

1. Go to Settings > Privacy and note which page is selected.
2. Open that page and read every Suggested text block.
3. Edit the text so it describes your site, and delete the suggestion labels.
4. Publish the page.
5. Load your site in a private browser window and look for the privacy link in the footer.

If step 5 shows no link, your theme may not print one on its own. We did not test themes, so check where your theme builds its footer.

When the policy page is part of a wider site check, we take a backup first and tell you what we change before we change it. That covers the setting and the link, never the legal wording.

What did we not test?

Our lab confirmed the draft status, the template’s size and the empty link functions on a fresh install. We did not test:

• what each theme does once the page is published
• the login screen footer link, which we only read about in the reference
• sites that were installed long ago and updated since
• what the template says in languages other than English

Our test site was a WordPress Playground install built from a script. No live host was involved.

What should you check today?

Open Settings > Privacy, click through to the selected page and check its status. Then find the link on your live site.

This is the same kind of quiet default as the box we wrote about in what the WordPress “discourage search engines” setting does: one setting, left as it was on day one, that nobody looks at after launch.

If you want a second look, tell us which plugins and scripts your site runs and we will check that your privacy page is selected, published and linked.