03.8 Development
Security &accessibility.
01 / 04Every website is scanned by bots every day. Yours too.
02 / 04Most break-ins come through outdated plugins, not clever hackers.
03 / 04Accessibility is the same kind of work: small fixes that let everyone in.
04 / 04And since June 2025, for most online shops and services, it is the law.
Scroll
What it is
Safe to use. Usable by everyone.
Website security is keeping attackers out and your site, data and customers safe: updated software, hardened logins, firewall rules, backups and someone watching. Accessibility is making sure people with disabilities can use the site: with a keyboard, a screen reader, zoom or limited vision.
They belong on the same page because they are the same kind of work: many small, unglamorous fixes that nobody notices until they are missing. And both have become legal questions. GDPR asks you to protect personal data, and the European Accessibility Act makes accessibility a requirement for most consumer e-commerce and digital services in the EU.
We build new sites this way from the start, and audit and fix existing ones. When something does go wrong, a calm plan beats panic; see our note on WordPress recovery mode.
The WordPress reality
WordPress is safe. Its plugins are the risk.
WordPress core is well maintained. Most real-world risk comes from the plugins and themes added to it, and from how slowly they are updated.
New vulnerabilities found in the WordPress ecosystem in 2025, according to Patchstack's State of WordPress Security report.
Of those vulnerabilities were in plugins, not in WordPress core. Fewer, better-maintained plugins is a security strategy.
Patchstack's weighted median time from disclosure to first mass exploitation. Updating “next month” is not a plan.
Hear the difference
The same form, heard without a screen.
People who are blind or have low vision move through a page with the keyboard while a screen reader announces each element. Missing labels turn a simple form into a guessing game. Pick a version and tab through it.
Security
What we harden on every site.
- Fewer plugins. Every plugin we can replace with a few lines of code is one less thing to patch.
- Updates with a process. Core, plugins and PHP updated quickly, tested on staging first.
- Hardened login. Rate limiting, strong passwords, two-factor authentication, no user enumeration.
- Edge protection. A CDN and firewall in front of the site, blocking bad traffic before it reaches the server.
- Backups you have tested. Daily, off-site, and restored at least once, so we know they work.
- Security headers. HTTPS everywhere, sensible headers and no information leaks in public endpoints.
- Least privilege. Every user and every API key gets only the access it needs.
- Monitoring. Uptime, file changes and known vulnerabilities watched, with alerts to a person.
The law
Accessibility is now a requirement.
The European Accessibility Act in Greece
The European Accessibility Act (Directive 2019/882) was transposed in Greece by law 4994/2022. Its requirements have applied since 28 June 2025 to many products and services sold to consumers, including e-commerce, banking, e-books and transport booking.
What compliance looks like
In practice, websites are measured against WCAG at level AA, through the European standard EN 301 549. That means readable contrast, keyboard access, labelled forms, text alternatives, clear errors and an accessibility statement. We are not lawyers; for legal questions, ask yours. We handle the technical work.
What you get
Audit, fix, keep it that way.
Audit
Automated scans plus manual testing with a keyboard and a screen reader, against WCAG 2.2 AA.
Prioritised fixes
Issues ranked by impact on real users, then fixed in code, templates and content.
Content guidance
Alt text, headings, link text and documents: a short guide so your team keeps it accessible.
Accessibility statement
A clear statement of what has been done, what remains and how people can ask for help.
Security audit
Plugins, users, configuration, headers and server, with a list of risks in plain language.
Maintenance plan
Monthly updates, monitoring, backups and accessibility checks, so the site stays where we left it.
How we work
From audit to peace of mind.
You get a clear timeline before we start.
Audit
Security and accessibility reviewed together, with real tools and real assistive technology.
Prioritise
A short report in plain language: what is urgent, what is important, what can wait.
Fix
We fix the issues in code and content, on staging first, then live.
Maintain
Ongoing updates, monitoring and periodic checks, because both drift over time.
Related
Safe and accessible from the first line.
Built in, not bolted on.
FAQ
Questions, answered.
Is WordPress secure?
WordPress core is well maintained. Most risk comes from plugins and themes and from slow updates. A site with few, well-maintained plugins, quick updates and good hosting is a hard target.
Does the European Accessibility Act apply to my website?
If you sell products or services to consumers online in the EU, very likely yes, since 28 June 2025. Some micro-enterprises providing services are exempt. We can review your case technically; for legal advice, ask your lawyer.
What standard should our site meet?
WCAG 2.1 or 2.2 at level AA is the practical benchmark, through the European standard EN 301 549.
Is an accessibility overlay plugin enough?
No. Overlays do not fix the underlying code and can get in the way of the assistive technology people already use. Real accessibility is fixed in the site itself.
Our site was hacked. Can you help?
Yes. We contain it, clean it, find how it happened, close the hole and harden the site so it does not happen again.
How often should a site be updated?
Security updates as soon as they are tested, often within days. A monthly maintenance routine covers the rest.
Do you offer maintenance plans?
Yes: updates, monitoring, backups, security checks and accessibility checks, with a monthly report.
How much does an audit cost?
It depends on the size and complexity of the site. After a short call we send a transparent proposal.
Lock the doors. Open the site.
Send us your URL for a security and accessibility check. One real reply within 24 hours.