Service Level
The following information applies strictly to WordPress websites created after the May 2025 release. If you own a WordPress website from before the official WordPress Service was made available, you remain responsible for all maintenance. You are further strongly recommended to start thinking about how you can best migrate to the centralised offering.
WordPress at CERN is managed centrally.
All upgrades, including those directly to WordPress as well as those to the CERN WordPress theme and any assorted plugins, are provided centrally and without action required on the website owner(s). There will be no possibility of fixing a website to a specific WordPress version. When interventions are not expected to be transparent, e.g. downtime is expected or they introduce a service change, they will be announced in a timely manner at the Service Status Board via an OTG.
On the central CERN WordPress Service, the following rules apply:
- only centrally included plugins may be enabled and used;
- only the centrally included CERN WordPress Theme may be used;
- must-use plugins enabled by default cannot be disabled, included
- authentication and authorization with the CERN SSO as configured by the Service, and
- role configuration managed via the Application Portal.
Any deviation from this requires an explicit approval by the Web Governance Board.
Disclaimer on Customisation
The CERN WordPress Service does not allow for customisation.
This decision by the Web Governance Board follows a thorough analysis of the Drupal ecosystem and the goals for the new CERN WordPress Service. In summary, it was concluded that the amount of time and resources demanded by each website in the form of support, maintenance, and compatibility work was directly correlated with the amount of customisation featured on the website. This cost was further not static, but instead increasing as websites aged and more backwards incompatible changes were released by Drupal.
At CERN, approximately 53% of all websites featured what was often both extensive and poorly documented customisation. We were thus dealing with an inherently complex and challenging ecosystem further strained by the weight of extensive CERN-specific customisation, increasing maintenance and necessary support work. Indeed, with exceedingly few exceptions, all extra support, maintenance, and compatibility work concerned customised websites.
As such, moving forward, it is the Web Governance Board's desire that the new Service provides an easier end-to-end experience for all websites. In particular, website owners should not be developers and there should be less technical knowledge required for website owners to ensure compatibility with the interventions. The singular task for website owners should be confined to content creation and content management. This approach seeks to ensure better, long-term maintenance of websites while improving general cohesiveness and conformance with CERN's digital identity and reputation.
While ad-hoc customisation will not be possible in WordPress as it was in Drupal, it is important to accentuate that customisation is not strictly forbidden. It is further important to stress that in this context, customisation strictly relates to the installation of third-party modules or plugins. Website owners will always be able to structure their websites as they desire, using the components provided centrally. Should a desired use-case not immediately be possible to achieve, website owners are encouraged to flag this such that a solution can be found. WordPress at CERN is a living and breathing offering subject to continuous updates and upgrades.
The CERN WordPress Service has been carefully designed to support all workflows and functionality offered by the CERN Drupal Distribution. This means that anything you could have created in Drupal using the CERN Drupal Distribution can be created in WordPress. In many cases, even customised Drupal websites will find that the default functionality in WordPress exceeds what they previously had available. However, as we do not wish to re-create Drupal inside of WordPress, some functionality is implemented and configured differently. Please browse through this documentation to attain a better understanding of how to work with WordPress.
In some instances, the solution will be to extend what is already present in the distribution, e.g. extending an existing Gutenberg block; tweaking an integration; or allowing additional configuration when importing or exporting feeds. In other instances, the solution will be to extend the central distribution with a third-party plugin. The addition of a third-party plugin is subject to thorough evaluation by the Web Presence Committee, ensuring compliance with not only Computer Security requirements and recommendations, but also elements such as data privacy, accessibility, license(s), and similar. It is, moreover, required that the requested feature(s) benefit more than just a single website.
Everything will be managed centrally and transparently for end users.
In conclusion, no customisations (theme, plugins, integrations) are allowed on the central infrastructure, apart from well justified use-cases who plan to actively develop their sites. For those, as mentioned above, an explicit exception must be sought from the Web Governance Board (see https://governance.web.cern.ch/) before initiating development. The website owner(s) must further accept that it will be their sole responsibility to ensure compatibility or fix any issues that might arise.
The following rules apply to websites who have received an explicit exception:
- customisations must be integrated and managed centrally for better transparency;
- customisation must to be managed and versioned via a custom theme hosted on the CERN Gitlab;
- both the Infrastructure and Web Teams must be granted full access to all repositories;
- commitment of human power to maintain codebase of customisations through out the lifetime of the website;
- commitment of human power to coordinate and ensure timely updates and upgrades;
- customisations remain the sole responsibility of website owners for the lifetime of the website;
- website owners will need to be available to react and respond to any security incidents; and
- accepting that website can be put offline at any moment if failing to comply.
A website is a living and breathing project that, much like a car, requires continuous support and maintenance. It is important to accentuate that any customisation will require continous support and thus resources. We highly discourage anyone from developing a customised WordPress website and invite you to contact us before proceeding in this direction.