CMP installed actually blocking non-essential cookies before consent

“Reject all” button at the same level as “accept all”

Google Analytics (or equivalent) anonymised and conditioned on consent

External fonts and resources hosted locally where possible

Forms with an explicit, non-pre-ticked consent checkbox

Defined retention period and automatic message purging

Privacy policy up to date, clear and accessible

Processing register maintained and up to date

Audit of third-party plugins and their data flows

Hosting and backups localised in the EU (or appropriate safeguards)

Right-to-erasure procedure tested and operational

Security updates current

WordPress GDPR self-audit: 12-point checklist

Understanding the checklist