NIS2 and WordPress: meeting the duty of care and supply chain audit history

NIS2 is a European cybersecurity directive that applies to many more sectors than the earlier NIS directive. Each EU member state transposes it into national law. Organisations in scope must take appropriate measures, such as risk management, handling vulnerabilities and reporting incidents.

Whether your organisation falls under NIS2 depends on sector and size. When in doubt, get legal advice.

A crucial part of NIS2 is supply chain security: organisations in scope are partly responsible for the cybersecurity of their suppliers and service providers. That includes web agencies and hosting companies managing WordPress sites.

If a WordPress website is connected to business-critical systems, customer portals or internal databases, it is directly part of the risk profile. A vulnerability in an outdated plugin or a misconfigured web server can be the starting point of an attack on the whole chain. Limiting damage afterwards is not enough; NIS2 requires a demonstrable, active duty of care.

With WordPress sites, most vulnerabilities come from plugins and themes that aren't updated in time. With dozens of sites, keeping track manually is nearly impossible.

One of the biggest challenges under NIS2 is the burden of proof. In an incident or audit you must show that you took appropriate technical and organisational measures beforehand. A snapshot or annual spot check is not enough.

That's why Securepress builds a continuous audit history. Scan results, incidents and vulnerability reports are retained, creating a historical record showing that security was monitored every day.

• Incident logging: every outage is recorded with start, end and duration
• Scan history: when a vulnerability was found and when it was fixed
• Reporting: monthly reports per site for management or clients

Securepress runs automated checks on multiple layers every day:

• Vulnerability check: WordPress core, themes and plugins are checked through Wordfence Intelligence, with WPScan as a fallback
• SSL and security headers: SSL certificate validity with a warning before expiry, and checks for HSTS, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options
• Sensitive files: detection of accidentally public files such as debug.log, .git/HEAD, readme.html or leftover wp-config backups
• System configuration: publicly reachable XML-RPC, default 'admin' usernames, publicly visible users, noindex status and inactive themes or plugins
• PHP version: warning when the PHP version no longer receives security updates

Is Securepress an official NIS2 certification?

No. Securepress provides the monitoring, audit history and reports to demonstrate that you meet the duty of care for the website part. Certification also covers organisational processes and human factors.

How long are security scans retained?

Individual per-minute uptime checks are only kept briefly to keep the database lean. Actual incidents (downtime) and security scans are retained for your monthly reports and audit history.