“AI tools built for your WordPress site”
WordPress is a website builder and an open-source CMS, as well as a hosted platform known as WordPress.com.
In the context of AI, WordPress now offers official features for text generation, rephrasing, translation, image generation and editing, design assistance, an AI website builder, and MCP-based agent integrations with tools such as Claude or ChatGPT.
In addition, the official WordPress AI team documents core-level components such as AI Client, the Abilities API, and the AI plugin.
WordPress
AI tools built for your WordPress site
Location: USA ⓘ Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, United States of America.
Premium Everything included in the Personal plan plus more storage, all premium themes, fast support, premium statistics, Google Analytics, and video uploads.
Business Managed WordPress hosting with more storage, 24/7 priority support, premium statistics, plugins, Google Analytics, video uploads, and developer features such as SFTP/SSH, WP-CLI, Git commands, and GitHub deployments.
Commerce For online stores with a WooCommerce-optimized environment, store themes, e-commerce tools, plugins, Google Analytics, video uploads, and developer features. Other Enterprise / WordPress VIP An enterprise offering for large organizations, with a focus on scalability, security, and data-driven WordPress experiences.
WordPress.org Self-Hosting Download the WordPress software for free and run it with your own hosting provider; you’ll then have greater responsibility for hosting, domain, security, updates, and data protection.
Advertisement
The target audience
for WordPress in the context of AI spans several levels at once: beginners who want to get started with the no-code AI Website Builder; bloggers and creators who want to write, rephrase, translate, and add images more quickly in the editor; freelancers and SMEs who want to accelerate their content and marketing workflows, and to larger organizations that want to securely integrate AI agents with site functions via MCP. For large enterprises, the appropriate solution is usually not the standard WordPress.com plan, but WordPress VIP.
Outstanding Features
The key differentiator is that WordPress embeds AI directly into the publishing and site management workflow. Officially available features include text generation, rewriting, tone adjustment, translation, title/excerpt generation, AI feedback, image generation, image editing, alt text/captions, prompt-based forms, design changes within the editor, and MCP-based agent connections to Claude, ChatGPT, and other clients. In addition, a technical foundation is being developed within the official Core environment, comprising the AI Client, the Abilities API, and the AI Plugin.
Key Areas of Application
Key areas of application include creating new websites, maintaining and optimizing existing sites, SEO and content workflows, image production and enhancement, landing pages, blog and news production, comment management, media organization, and—via MCP—operational tasks such as creating, editing, publishing, and structuring content using natural language. For e-commerce, commerce workflows are also included; in the enterprise sector, WordPress VIP is designed for scaled content and digital experience setups.
Usage & Notes
: There are four key points to keep in mind. First: The AI Assistant on WordPress.com is plan-dependent and is particularly relevant for existing sites, especially Business/Commerce sites, while the AI Website Builder also offers more affordable options for new sites. Second: The Assistant works best with block themes; classic themes lack the full range of editor features. Third: For AI-built sites, WordPress uses the Assembler theme approach; changing the theme deactivates the AI Builder feature, but not the site itself. Fourth: WordPress.com has content guidelines in place, including measures against spam and abusive machine-generated content. For data protection and governance, you should also carefully decide whether to use self-hosted WordPress.org, WordPress.com, Jetpack services, or external agents via MCP.
| Target Audience | Assessment |
|---|---|
| Individuals | Highly suitable—for blogs, personal websites, portfolios, and simple AI-powered website creation without coding. WordPress.com offers an AI Website Builder that allows users to create websites without templates or technical knowledge. |
| Self-Employed / Freelancers | Highly suitable – for portfolios, blogs, landing pages, client acquisition, SEO, content creation, and simple business websites. |
| SMEs | Highly suitable—especially for websites, blogs, business sites, member areas, plugins, SEO, analytics, and WooCommerce stores. WordPress.com offers plans ranging from Free to Commerce, as well as managed hosting. |
| Large Enterprises | Suitable—especially via Enterprise / WordPress VIP for scalable, secure, and editorially complex WordPress setups. |
| Developers / Agencies | Highly suitable—especially with Business/Commerce due to plugins, SFTP/SSH, WP-CLI, Git commands, and GitHub deployments; alternatively, WordPress.org can be self-hosted. |
Hosting & Data
1) On-prem / local hosting
Meaning: The company operates the solution on its own hardware or within its own infrastructure. In the strictest sense, not only the application runs locally, but ideally the model as well.
2) Private cloud / data center
Meaning: The solution runs in a dedicated or more clearly separated cloud environment, often with a hosting provider or hyperscaler, but in a German data center or in a particularly controlled environment.
3) EU SaaS / managed
Meaning: The provider operates the solution itself as a service. The company uses the tool as a ready-made cloud service, ideally with EU data residency.
4) Hybrid
Meaning: One part of the processing remains internal / local / in a private cloud, while another part runs in an external cloud or EU SaaS.
5) AVV / DPA
Meaning: This is the data processing agreement or Data Processing Addendum. It governs that the provider processes personal data on behalf of the customer and is bound by the customer's instructions.
6) No training
Meaning: The provider does not use your prompts, uploads, attachments, chat histories, or outputs for training or improving the general model — ideally excluded by contract.
7) Open-source / transparency path
Meaning: There is a path toward greater technical transparency and sovereignty, for example through:
- open models
- documented components
- self-hostable parts
- traceable architecture
- export / switching options
| On-prem / local hosting | ⚠️ |
| Private cloud / data center | ⚠️ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ❓ |
| DPA / AVV | ✅ |
| No training on customer data | ❓ |
| Open source / transparency path | ✅ |
On-Prem / local hosting: partial
The website describes WordPress.com as a hosted platform, but at the same time explicitly points out that the open-source WordPress software can be installed on any hosting. A true on-premise operating model for the WordPress.com service or the AI features themselves is not specified on the website.
Private cloud / data center: partial
The website documents the selection of a primary data center, including 'EU West', as well as replication and failover between data centers. A dedicated private cloud or clearly separated customer environment for regular WordPress.com users is not specified on the website.
EU SaaS / managed: partial
WordPress.com is clearly documented as a managed hosting/SaaS offering. For hosting features, 'EU West' can be selected as the primary data center. At the same time, however, the website describes a global infrastructure with replication to other regions; a binding exclusive EU data residency for the entire service is not specified on the website.
Hybrid: indirect / not available
A mixed operating model consisting of internal/local processing and external WordPress.com SaaS is not described on the website as a product or deployment model. Indirectly, it is only apparent that open-source WordPress can also be operated elsewhere and that content can be migrated/exported.
DPA / DPA: covered
The website explicitly provides a 'Data Processing Agreement'/'Data processing addendum' for all WordPress.com site operators and describes it as a supplement to the terms of use as well as an agreement for documenting GDPR requirements and standard contractual clauses.
No training: unclear
No reliable statement was found on the website that prompts, uploads, chat histories, or outputs of the WordPress AI features are not used to train general models. Only a general opt-out for account usage/tracking analytics was found, not for AI training.
Open source / transparency path: covered
The website explicitly describes WordPress.com as a hosted version of the open-source WordPress software and explains that WordPress can be installed on any hosting. In addition, export/import and migration options are described, which supports a transparency and sovereignty path.
Data processing
The website describes WordPress.com as a self-operated managed hosting service with globally distributed infrastructure. There are multiple data centers in the USA and worldwide; for certain hosting features, a primary data center can be selected, including 'EU West'. At the same time, real-time replication to a second data center in another region is described. For business use involving personal data of other persons, an AVV/DPA can be requested. Information on subprocessors, exclusive EU data residency for all data flows, and an AI-specific no-training commitment was not found on the website.
Conclusion
For users in the EU/EEA, WordPress is not documented across the board as fully GDPR-compliant, but there is a reliable partial path: AVV/DPA plus primary data center 'EU West'. Due to the global infrastructure, cross-region replication, and missing website information on subprocessors, exclusive EU data residency, and AI training, overall use remains only conditionally classifiable. The open-source nature of WordPress improves sovereignty, but does not replace clear documentation for WordPress.com SaaS and AI processing.
Sources
- https://wordpress.com/support/data-processing-agreements/
- https://wordpress.com/support/choose-a-host/
- https://wordpress.com/blog/2022/12/16/maximize-your-sites-performance-by-choosing-your-primary-data-center/
- https://wordpress.com/support/automattic-inc/
- https://wordpress.com/support/tracking-opt-outs/
- https://wordpress.com/blog/2024/09/26/our-wordpress-contributions/
- https://wordpress.com/website
- https://wordpress.com/blog/2025/04/09/ai-website-builder/
| On-prem / local hosting | ⚠️ |
| Private cloud / data center | ⚠️ |
| EU SaaS / Managed | ⚠️ |
| Hybrid | ❓ |
| DPA / AVV | ✅ |
| No training on customer data | ❓ |
| Open source / transparency path | ✅ |
On-Prem / local hosting: partial
The website describes WordPress.com as a hosted platform, but at the same time explicitly points out that the open-source WordPress software can be installed on any hosting. A true on-premise operating model for the WordPress.com service or the AI features themselves is not specified on the website.
Private cloud / data center: partial
The website documents the selection of a primary data center, including 'EU West', as well as replication and failover between data centers. A dedicated private cloud or clearly separated customer environment for regular WordPress.com users is not specified on the website.
EU SaaS / managed: partial
WordPress.com is clearly documented as a managed hosting/SaaS offering. For hosting features, 'EU West' can be selected as the primary data center. At the same time, however, the website describes a global infrastructure with replication to other regions; a binding exclusive EU data residency for the entire service is not specified on the website.
Hybrid: indirect / not available
A mixed operating model consisting of internal/local processing and external WordPress.com SaaS is not described on the website as a product or deployment model. Indirectly, it is only apparent that open-source WordPress can also be operated elsewhere and that content can be migrated/exported.
DPA / DPA: covered
The website explicitly provides a 'Data Processing Agreement'/'Data processing addendum' for all WordPress.com site operators and describes it as a supplement to the terms of use as well as an agreement for documenting GDPR requirements and standard contractual clauses.
No training: unclear
No reliable statement was found on the website that prompts, uploads, chat histories, or outputs of the WordPress AI features are not used to train general models. Only a general opt-out for account usage/tracking analytics was found, not for AI training.
Open source / transparency path: covered
The website explicitly describes WordPress.com as a hosted version of the open-source WordPress software and explains that WordPress can be installed on any hosting. In addition, export/import and migration options are described, which supports a transparency and sovereignty path.
Data processing
The website describes WordPress.com as a self-operated managed hosting service with globally distributed infrastructure. There are multiple data centers in the USA and worldwide; for certain hosting features, a primary data center can be selected, including 'EU West'. At the same time, real-time replication to a second data center in another region is described. For business use involving personal data of other persons, an AVV/DPA can be requested. Information on subprocessors, exclusive EU data residency for all data flows, and an AI-specific no-training commitment was not found on the website.
Conclusion
For users in the EU/EEA, WordPress is not documented across the board as fully GDPR-compliant, but there is a reliable partial path: AVV/DPA plus primary data center 'EU West'. Due to the global infrastructure, cross-region replication, and missing website information on subprocessors, exclusive EU data residency, and AI training, overall use remains only conditionally classifiable. The open-source nature of WordPress improves sovereignty, but does not replace clear documentation for WordPress.com SaaS and AI processing.
Sources
- https://wordpress.com/support/data-processing-agreements/
- https://wordpress.com/support/choose-a-host/
- https://wordpress.com/blog/2022/12/16/maximize-your-sites-performance-by-choosing-your-primary-data-center/
- https://wordpress.com/support/automattic-inc/
- https://wordpress.com/support/tracking-opt-outs/
- https://wordpress.com/blog/2024/09/26/our-wordpress-contributions/
- https://wordpress.com/website
- https://wordpress.com/blog/2025/04/09/ai-website-builder/
Strengths & weaknesses at a glance
| Strengths | Weaknesses |
|---|---|
| Very robust ecosystem; official AI features built directly into WordPress instead of external copy-and-paste; AI Website Builder for a quick start; MCP for agency workflows; Plugin installation included on all paid WordPress.com plans, with access to 50,000+ plugins; for enterprise users, there is a separate offering called WordPress VIP. Many plugins are available for free in the store for any application. A WordPress website can, in theory, be scaled extremely high. | This is not an “out-of-the-box” AI tool designed solely for chat or prompt use, but rather one tied to website workflows; AI availability depends on the plan and setup; the full WordPress.com AI Assistant works best with block themes; with Classic themes, it does not appear in the editor; WordPress.org, WordPress.com, Jetpack, and VIP are commercially and functionally separate; WordPress.com also has policies against spam and machine-generated content. |
Reviews
2 reviews in total
Submit review
Your review will only become visible after email confirmation. This protects the portal against abuse.
Report review
Please select the reason why this review should be checked.
GDPR-compliant usage possible?
For the EU/EEA area, GDPR-compliant use with WordPress is partially demonstrable, but not comprehensively for the standard SaaS variant. Positive aspects include an explicitly offered DPA/AVV for WordPress.com site operators, standard contractual clauses in connection with the DPA, and the option to choose a primary data center in the 'EU West' region for hosting features. At the same time, the website states for WordPress.com a globally distributed infrastructure with replication/fallback across regions; exclusive EU/EEA data processing for the entire platform and specifically for the AI features is not clearly guaranteed on the website. Therefore, a reliable EU/EEA GDPR assessment is only sustainable under certain conditions.
Positive
The website documents a DPA/AVV for all WordPress.com site operators, a reference to GDPR data transfers via standard contractual clauses, EU/UK consent management for tracking, and a selectable primary hosting region 'EU West'. In addition, WordPress is explicitly described on the website as open-source software, and WordPress.com points out that WordPress can also be installed with other hosting providers.
Negative
The website does not document exclusive EU/EEA data residency for WordPress.com as a whole. Instead, distribution across multiple data centers in the USA and worldwide is described, including replication to a second region. Subprocessors were not found on the website. A specific statement that inputs, uploads, or outputs of the AI features are not used to train general models was not found on the website. Relevant certifications such as ISO 27001 or SOC 2 are not specified on the website for WordPress.com.
Server location
According to the website, WordPress.com hosts on thousands of servers in multiple data centers in various parts of the USA and worldwide. For certain hosting features, 'EU West' can be selected as the primary data center, among other options. In addition, the website describes real-time replication to a second data center in another region. Exclusive EU/EEA hosting for WordPress.com as a whole is not specified on the website.
