WordPress for government and public sector in 2026

The era of governments buying expensive, proprietary, closed-source software is ending. From NASA to the White House, public sector websites are moving to WordPress.

Why? In 2026, the driving forces are Digital Sovereignty, Accessibility, and the “Public Money, Public Code” movement.

This guide explains why WordPress is a strong choice for modern GovTech.

#1. What is “Public money, public code”

If a city builds a digital park reservation system using tax dollars, why should that code be owned by a private corporation?

The “Public Money, Public Code” initiative argues that software paid for by the public should be available to the public.

• Proprietary CMS: You rent the software. If you stop paying, your website disappears. You cannot share your improvements with neighboring cities.
• WordPress (Open Source): You own the code. If the City of Warsaw builds a great “Pothole Reporting” plugin, the City of Krakow can use it for free. This is efficient government.

#Who backs the public money, public code campaign

The campaign is run by the Free Software Foundation Europe (FSFE). Its open letter asks for legislation requiring that publicly financed software developed for the public sector be released under a free and open source licence. According to the FSFE campaign page, more than 200 civil society organisations and over 31,000 individuals have signed it.

The principle now appears in law and in city coalition programmes:

• United States: the SHARE IT Act, signed on 23 December 2024 as Public Law 118-187, requires federal agencies to publish metadata about their custom-developed code and to share that code with other agencies. National security systems, classified code and code that carries privacy risks are exempt (FedScoop).
• European Union: the Interoperable Europe Act, Regulation (EU) 2024/903, entered into force on 11 April 2024. Public bodies must assess interoperability before taking binding decisions on cross-border digital public services, and that assessment duty has applied since January 2025 (European Commission webinar on the Act).
• Munich: after moving its desktops to the Linux-based LiMux, the city council voted in November 2017 to return to Windows. The coalition agreement of May 2020 then adopted the “public money, public code” principle: the source code of city software is to be published unless it contains confidential or personal data (LiMux on Wikipedia).

#What the GPL licence means for a city plugin

WordPress is released under the GPLv2 or later, and the project’s position is that plugins and themes are derivative works that inherit the GPL (WordPress licence page). When a city hands its plugin to a neighbouring municipality, the receiving city may run it, study it, change it and pass it on.

The licence does not force publication. Code that stays inside one administration is never distributed, so GPL obligations to share source are never triggered. The duty to publish comes from procurement rules and policies such as the SHARE IT Act or Munich’s coalition agreement. A tender for a WordPress project should therefore state who owns the custom code, under which licence it is released and in which public repository it will live.

#2. Is WordPress secure enough for government websites

“But WordPress gets hacked!” Only cheap, badly managed WordPress gets hacked.

Enterprise Government WordPress is a different beast.

1. FedRAMP Authorization: Hosting leaders like WordPress VIP have achieved FedRAMP “Authority to Operate”. This means they meet the stringent security controls required by the US Federal Government.
2. Immutable File Systems: The server is “read-only”. Even if a hacker found a vulnerability, they cannot write a malicious file to the server.
3. SSO (Single Sign-On): Government employees log in using their secure Active Directory / Azure AD credentials, encompassing 2FA and hardware keys (YubiKey).

#What FedRAMP authorization covers for WordPress hosting

FedRAMP is the US federal programme that authorizes cloud services for use by federal agencies. WordPress VIP, operated by Automattic, received its initial FedRAMP authority to operate in 2021 and announced FedRAMP Moderate authorization in April 2025 (WordPress VIP). On the Drupal side, Acquia received an ATO from the US Department of the Treasury in 2016, and in October 2024 Acquia Cloud Next reached Authorized status (Acquia).

The authoritative list is the FedRAMP Marketplace. Check the current status and impact level there before a procurement decision, because vendor pages can lag. The authorization covers the hosting platform. Plugins, the theme, custom code and the site configuration that an agency deploys on top of it remain the agency’s responsibility.

#How to make a WordPress filesystem read-only

WordPress ships two constants for this. DISALLOW_FILE_EDIT turns off the plugin and theme file editor in wp-admin. DISALLOW_FILE_MODS blocks plugin and theme installation and updates from the admin area and disables the file editor as well (WordPress wp-config documentation). With DISALLOW_FILE_MODS set, code reaches production only through the deployment process:

• The production filesystem is mounted read-only, with a separate writable location for media uploads.
• Core, plugin and theme updates are deployed through a controlled CI/CD pipeline.
• Each release is built from a reviewed commit, so the running code can be traced back to an approved change.
• Audit logs record every attempt to modify files on the server.

#What single sign-on gives a government CMS

With SSO, the identity provider becomes the one place where staff access is granted and removed:

• Access is revoked centrally the day an employee leaves the organisation.
• Password and multi-factor policies are set once, in the identity provider, for every system.
• Each login is recorded for audit.
• The CMS joins the identity systems the administration already runs.

#Zero trust architecture for a government WordPress site

NIST Special Publication 800-207, finalized in August 2020, describes zero trust as a set of concepts that move protection away from fixed network perimeters and toward users, devices and the resources they access (NIST SP 800-207). Applied to a WordPress stack, it means:

• Every request to the admin area and the API is authenticated and authorized on its own.
• Being inside the office network grants no trust.
• The web servers, database and admin access run in separate network segments.
• Unusual behaviour, such as logins at odd hours or bulk content changes, is monitored continuously.

#3. WCAG 2.2 accessibility for government WordPress sites

Governments have a legal mandate (the Web Accessibility Directive in the EU, Section 508 in the US) to be accessible to all citizens. For private businesses, the EAA in Europe adds a separate set of duties.

Proprietary “Page Builders” often generate messy, inaccessible code (div soup). Headless WordPress or Custom Gutenberg Blocks allow developers to output semantic, pristine HTML that is aligned with WCAG 2.2 AA checks.

• Case Study: NASA relaunched nasa.gov on WordPress in 2023. The 21st Century IDEA Act, quoted in NASA’s 2021 IDEA Act report, requires agencies to ensure, to the greatest extent practicable, that every new or redesigned federal website is accessible in accordance with Section 508.

#Which accessibility law applies to government websites

The European Accessibility Act is the law most often quoted, but Directive (EU) 2019/882 covers products and services from private economic operators. Websites and apps of public sector bodies fall under the Web Accessibility Directive, Directive (EU) 2016/2102. In the US the split runs between federal agencies and state and local governments.

The Department of Justice published the Title II rule on 24 April 2024 and moved its compliance dates back in an interim final rule of 20 April 2026 (ADA.gov). The EU directive also requires each public body to publish an accessibility statement and to offer a feedback mechanism for users who hit a barrier, and member states monitor compliance and report on it to the Commission.

#What WordPress core commits to on accessibility

The WordPress coding standards state that new or updated code released in WordPress is expected to conform to WCAG 2.2 at level AA (WordPress accessibility coding standards). That commitment covers WordPress itself. Third-party themes and plugins are outside it, so each one an administration installs needs its own audit.

Page builders that generate markup automatically tend to fail in the same places:

• Headings out of hierarchical order.
• Images without meaningful alternative text.
• Form fields without correctly associated labels.
• Insufficient colour contrast.
• Broken keyboard navigation.

Custom blocks fix these at the source. The developer controls the HTML structure of each component, can enforce accessible patterns by default (a required alt text field, a fixed heading level) and can run automated accessibility tests in the build pipeline before anything reaches editors.

#4. How government websites survive traffic spikes

When a pandemic hits, or a natural disaster strikes, government websites see sudden traffic spikes. A server that renders every page on request can fall over.

Static WordPress: For critical information pages, we often use “Static Site Generation” (Simply Static / Headless).

• The page is converted to a plain HTML file and distributed to thousands of global CDN nodes.
• There is no database to overload, and the CDN keeps serving cached copies if the origin goes down.

#Which layers keep a government site online under load

1. Global CDN: content is served from edge locations close to the reader.
2. Automatic failover: if one node fails, traffic moves to the next one.
3. Full-page cache: static pages are served from memory without running PHP or querying the database.
4. Autoscaling: the origin infrastructure adds capacity when traffic rises.

#How one CMS feeds web, apps and alerts

Crisis communication reaches beyond the website. Through the WordPress REST API, the same content entry can be published on the website, in mobile apps and on public information screens, and pushed to emergency notification systems. Editors update one source, and every channel shows the same text.

#5. WordPress vs Sitecore and AEM licence model for government

Proprietary enterprise CMS products are licensed for a recurring fee, quoted individually by the vendor. That is taxpayer money spent on software rent.

With WordPress:

• License: $0.
• Budget Shift: The licence budget can be shifted to Feature Development. Instead of paying for the right to use the software, the government pays to improve the software for citizens.

#What one administration can reuse from another

When one city develops a feature in WordPress and publishes it under the GPL, other administrations can take it over:

• Online appointment booking.
• Transparency and open data portals.
• Citizen participation and consultation tools.
• Electronic case handling forms.

#Drupal vs WordPress vs Sitecore vs Adobe Experience Manager for government websites

Government CMS selection often comes down to four contenders. Here is how they compare on the criteria that matter most for public sector deployments.

The criteria matrix below is a qualitative comparison against public product docs for Drupal, Sitecore, and Adobe Experience Manager.

WordPress wins on cost, editor experience, and talent availability. Drupal wins on structured content modeling for complex government data (census portals, regulatory databases). Sitecore and AEM are justified only when the organization already has enterprise agreements and dedicated vendor teams.

For most government websites (information portals, service directories, news sites, internal intranets), WordPress covers most of the required functionality without licence fees. The rest (complex workflow engines, multi-jurisdiction data federation) can be addressed through headless WordPress with specialized microservices.

#6. Government websites built on WordPress

• The White House (whitehouse.gov): The site ran on Drupal from 2009 and relaunched on WordPress on 15 December 2017 (eWeek). In January 2021 it relaunched again on WordPress and the block editor, with the agency 10up involved (Matt Mullenweg, 10up).
• NASA (nasa.gov): NASA’s 2021 IDEA Act report records the selection of WordPress as the agency’s future CMS. The same report says 158 public domains were removed in 2021 and that the Science Mission Directorate was consolidating more than 30 top sites, about half of NASA’s traffic in fiscal year 2021. The new flagship site went into public beta in August 2023, built and hosted with WordPress VIP and its partner Lone Rock Point (WordPress VIP).
• thisisFINLAND (finland.fi): Listed in the WordPress.org showcase, produced by the Ministry for Foreign Affairs of Finland and published by the Finland Promotion Board.
• Gov.uk: Uses open standards and modular components. It does not run on WordPress: the Government Digital Service builds its own publishing applications and publishes their source code on GitHub, which makes it a reference case for public money, public code rather than for a particular CMS.

#7. How to implement WordPress in public administration

#Recommended architecture for 2026

1. The citizen’s request first reaches a CDN with a web application firewall.
2. A load balancer distributes traffic across application servers.
3. WordPress runs headless as the editorial back end.
4. Content is exposed through the REST API or GraphQL.
5. A frontend built with Astro or Next.js renders the pages.
6. A global edge cache serves the rendered pages to citizens.

#Government security checklist

• FedRAMP authorization or the local equivalent verified for the hosting provider
• SSO with MFA in place for every user
• Immutable filesystem in production
• 24/7 security monitoring active
• Incident response plan documented and tested
• Regular security audits by independent third parties
• Encryption of sensitive data in transit and at rest
• Complete audit log kept for compliance

#8. Conclusion

Learn more about WordPress security services at WPPoland. Using WordPress in government is not just a technical choice; it is an ethical one. It supports the values of openness, transparency, and accessibility that democratic governments strive for.

At WPPoland, we help public sector entities migrate from legacy proprietary systems to secure, modern Open Source stacks.