WordPress. For enterprises.

WordPress core has a security team. Small security fixes can install on their own, so a site is not waiting on someone to notice a release post. That is the part that gets left out when WordPress is compared with a platform that charges for the next version.

The rest is how the site is run:

• Accounts have roles. Someone who publishes a page does not need to be an administrator.
• The people who can log in use two-factor authentication. Some hosts insist on it. We do too, on any account that can change the site.
• There is no shared admin password, and no account literally named admin.
• WordPress, the plugins you actually use, and the theme get updated. There is a backup first.
• The host is current: a supported PHP version, TLS, and something in front of the site if it is busy or has been attacked before.

We do not start this work by selling a security plugin. Those add a dashboard and, often, a slower site. They do not replace the list above. If the site has already been hacked, that is a cleanup, and then the list. After that, someone has to keep updating it.

Core also gives developers the boring tools that stop the common holes: escaping on output, nonces on forms, and capability checks before an admin screen loads. They only help if the theme and the plugins use them. That is one reason we would rather have fewer plugins.

You can read the code, change it, and give it to another developer. The domain, the hosting login and the content should be in the organisation's name. When we work on a site, that stays true. You are not renting the site from us.

A platform you rent, or a CMS only one vendor is allowed to touch, comes with one invoice and one roadmap. That can feel simpler. It is also how an organisation gets stuck the year the vendor changes the price, or the year you want a feature they will not build.

WordPress has the opposite problem. Hosts, plugins, agencies and freelancers all sell a version of it, and the messages do not match. Someone still has to choose. That is the work. A single vendor does not remove the need for that choice. It hides it in the contract.

The costs that do not go away:

• The build, or the move off the old system. Quoted, once we know the size.
• Hosting that matches the traffic. A national publisher and a three-office professional firm do not belong on the same plan.
• A person who updates it and notices when a form stops sending.

People who can work on WordPress are not scarce in Ireland. That matters on the day we are not the ones doing it. You should be able to leave, and the next developer should be able to read the site.

We will not put a single euro figure on this page. A department site with ten editors is not a migration of twenty years of articles. The €500 site is neither of those. If someone quotes you an enterprise project at the small-business price, ask what they left out.

RTÉ and the Irish Times are not on WordPress. A lot of organisations a buyer would call serious still are.

• Publishing: The Irish Sun, Business Post, The Currency, AgriLand.
• Education: Technological University of the Shannon, Atlantic Technological University.
• Public bodies: Transport for Ireland, the Residential Tenancies Board, ComReg.
• Charities: Trócaire.

The list, the rank, and how a homepage was counted are in WordPress is still relevant. They are there so you can see the software is already in Irish publishing, education, transport, regulation and charities.

Outside Ireland, large publishers have moved decades of articles and pictures onto WordPress without taking the site down to do it. That is evidence the software can hold a big archive. It is not evidence that a brochure agency, on a shared host, can do the same job. The hosting and the migration plan are the actual work. Email and DNS come first, the same as on a smaller move, because that is what people notice when it goes wrong.