IT risk assessment for WordPress sites: a simple method
A simple IT risk assessment for WordPress sites: list assets, name threats, rate on a 1–3 scale, pick measures and owners, with a worked example register.
Compliance
Guides on Compliance for WordPress sites in the EU — practical steps, the legal background and checklists.
Data processing agreement for web agencies (GDPR Art. 28)
When a web agency needs a data processing agreement (GDPR Art. 28), what the security annex should cover, subprocessors, incident reporting and offboarding.
WordPress security audit report: what evidence to keep
How to build a WordPress security audit report: the six records to keep, what good evidence looks like, supplier and insurance questions, and a template.
NIS2 and your WordPress site: are you in scope?
NIS2 and WordPress: check if your company, agency or hosting business is in scope, what suppliers should expect, and which Art. 21 measures affect your site.
Google Fonts and GDPR: self-host fonts on WordPress
Google Fonts and GDPR: what the Munich court ruled, why the Data Privacy Framework doesn't settle it, and how to find and self-host fonts on WordPress.
GDPR Article 32 for WordPress: what 'appropriate security' means
GDPR Article 32 and WordPress security in practice: encryption, updates, access control, tested backups, regular scans, records and processor contracts.
Cyber Resilience Act: what WordPress plugin sellers must do
Cyber Resilience Act for WordPress plugin and theme sellers: reporting duties since 11 September 2026, the December 2027 obligations, and a to-do list.