The Human Made blog

WordPress security governance covers the decisions an organisation makes about who owns its platform, who can access it, how the software it depends on stays up to date, and which third parties and AI tools connect to it. In the enterprise estates we audit, most security incidents trace back to one of those decisions. At…

Without governance, unapproved AI tools will creep into your WordPress site over time, often through a series of small and seemingly innocuous decisions. Whether it’s an editor who wants to try a new assistant, or a developer who connects a model to the codebase, it’s natural for your team to want to adopt the tools…

Key takeaway: In the open source vs proprietary CMS security debate, open source holds up well in the enterprise space. WordPress keeps vulnerabilities private until a fix is ready, then delivers it through automatic updates by default. With either model, how your team runs the platform is what matters most. Enterprise security teams often ask…

Most site owners only see one part of the process that results in a new version of WordPress being released that fixes a security vulnerability: a dashboard notification that reads “An updated version of WordPress is available”. That’s intentional, the software is built to “just work”. Everything before that notification happens behind the scenes, often…

Knowing how to evaluate an enterprise WordPress agency comes down to four things that rarely show up clearly in a pitch. Those four things are technical capability, delivery maturity, security and governance, and strategic alignment. A visually impressive site means very little if the platform becomes difficult to scale, maintain, or govern six months after…

Choosing the wrong WordPress agency rarely looks like a mistake at the time. It looks like a great pitch, a polished proposal, and a shortlist of impressive client logos. The problems don’t surface until months into delivery — and by then, switching agencies costs time, money, and momentum. The right questions can surface most of…

The cost of choosing the wrong WordPress agency rarely shows up at launch. It surfaces quietly, months or years later. A platform that once felt like a win starts costing more with every release. The financial cost of a bad agency choice is the easy part to calculate — it’s on the invoice. The total…

Enterprise WordPress security is often discussed in technical terms. Keep software up to date. Strengthen authentication. Monitor vulnerabilities. Choose secure infrastructure. Follow security best practices. They’re all sensible recommendations. The difficulty is that very few enterprise platforms become more or less secure because of a single technical decision. They change gradually as the organisation around…

Every month, enterprise organisations connect more AI systems to their digital estate. For organisations running WordPress at enterprise scale, these new services are changing the security landscape. AI assistants, content generation tools, developer agents, search experiences, and workflow automations increasingly interact with WordPress content, APIs, and business systems. Each new integration creates opportunities for innovation…

Choosing an enterprise WordPress agency should be a straightforward process. Define your requirements on the RFP, invite proposals, compare responses, and select the partner that best fits your needs. In reality, it’s rarely that simple. Most enterprise buyers aren’t choosing between obviously good and obviously bad agencies. They’re choosing between several capable teams with strong…

Enterprise platform discussions often begin with software costs. Licence fees, subscription models, implementation budgets, and support agreements are relatively easy to compare during procurement. They are visible, measurable, and usually well documented by vendors. The challenge is that software costs represent only one part of a platform’s economic impact. Once a platform is embedded across…