Four plugin backdoors in a month: WordPress supply chain in 2026
Austin Ginder disclosed four WordPress.org plugin backdoors in 30 days, plus an author who ran a hidden update server for five years. What it means for NIS2 and DORA dependency maps.
We are not just a remote agency. We are an active part of the ecosystem. We believe in Open Source and contributing back to the community that powers 43% of the web.
Specific Context: Scalable architecture for growing products, strong security baselines, and multilingual user journeys optimized for regional and international audiences.
Connecting with fellow developers in the Poznań region.
Join us at the next event →In Poznań's competitive market, site speed is your strongest SEO asset. WCAG accessibility engagements are designed against a performance budget with Core Web Vitals measured at every stage.
For Startups & Enterprise in Poznań, accessibility is part of the contract with the user, so we treat it like any other security control - with regression tests in CI, not just a one-off audit. Pa11y, axe-core and Playwright check WCAG 2.2 AA on every PR; in parallel we run manual passes with NVDA and VoiceOver because scanners miss focus order, ARIA mistakes and live-region announcements. Ahead of the European Accessibility Act coming into force in June 2025, Poland businesses get a remediation plan that holds up to a real user.
The European Accessibility Act, in force from June 2025, turns WCAG 2.2 AA from good practice into a legal duty for most consumer-facing services in Poland, and the test that matters is keyboard plus screen reader, not just axe-core. We audit Poznań sites manually with NVDA, JAWS and VoiceOver, measure 4.5:1 contrast, focus order and ARIA landmarks, then deliver a remediation plan prioritised by real user impact rather than red-badge count in a scanner. Clients leave with a fix list that holds up to both a supervisory body and an actual user - those are not the same audit.
For Startups & Enterprise in Poznań, we offer tailored WCAG accessibility solutions. Scalable architecture for growing products, strong security baselines, and multilingual user journeys optimized for regional and international audiences.. We understand the challenges faced by businesses in this region and deliver technologies that genuinely impact business results.
We've worked with companies from Poznań and surroundings, delivering WCAG accessibility solutions that increased their online presence. Our projects include startups & enterprise - from corporate websites to advanced e-commerce platforms.
Our clients from Poznań achieve measurable results: faster page loads (up to 70% faster), better search engine rankings, and increased conversion. We operate locally but with quality standards recognized worldwide.
Explore selected projects supporting our clients' success.
Hello! Here is metal-meble.pl – a project I built as a developer to show how advanced technical solutions can support a company offering metal furniture and ...
mochola.com is a modern e-commerce platform based on WooCommerce, which I developed as a programmer, specializing in the sale of car parts. The store is aime...
nehrebeccy.pl is a modern artistic agency that combines expertise in organising cultural events with a rich presentation of artistic offerings. The site was ...
We specialize in serving Startups & Enterprise in Poznań and surrounding areas. Our WCAG accessibility solutions are tailored to the local market. In practice, this means a focus on Core Web Vitals, local intent, and information architecture tailored to the Poznań market.
Let's discuss how we can bring top-tier performance to your project.
Schedule free consultation in PoznańStay updated with the Accessibility Audit-Wcag community
Austin Ginder disclosed four WordPress.org plugin backdoors in 30 days, plus an author who ran a hidden update server for five years. What it means for NIS2 and DORA dependency maps.
CRA covers products with digital elements. NIS2 covers entities. DORA covers financial entities. When all three apply at once, headless WordPress sits at the intersection. I sketch what the joint evidence package looks like in 2026.
Article 28 of Regulation 2022/2554 makes financial entities responsible for the ICT risk of every third-party they touch. I walk through the supplier due-diligence checklist I ship with WordPress engagements for banks and insurers in 2026.
Article 28(3) of Regulation 2022/2554 obliges financial entities to keep a Register of Information on every ICT third-party arrangement. The fields a WordPress agency must populate to be entered.
How to ship a Tailwind v4 design system inside WordPress 6.7+ block themes without breaking editor parity, theme.json tokens or JIT compilation. A practitioner playbook covering setup, block patterns, and the gotchas.
More articles are available on /en/blog/
Strengthen your business with professional technical support in key areas of the WordPress ecosystem.
Audit, hardening, and incident risk reduction.
Stability, updates, and post-launch support.
Custom WordPress engineering and architecture.
Core Web Vitals, caching, and faster delivery.
Migration to Astro, Next.js, and headless WordPress.
Visibility in Google and AI answer systems.
A comprehensive WordPress security hardening guide for 2026 covering server configuration, authentication with Passkeys, WAF setup, CSP headers, database protection, headless security, and a 25-point audit checklist.
A practical guide to hardening WordPress in 2026 with passkeys, edge protection, infrastructure controls, and safer operational habits.
Still using "admin"? You are being hacked right now. The definitive guide to securing WordPress authentication: 2FA, Passkeys, Fail2Ban, Cloudflare Turnstile, login monitoring, and incident response procedures.
Over the past years, I've worked on over 80 different websites for companies, organizations, and agencies. I help with everything: from UI/UX design, through development, to security and maintenance.
Working Hours
Mon-Fri: 8:00-19:00 Sat-Sun: 10:00-19:00
CEST Time zone
Starowiejska 16/2, 81-356 Gdynia, Poland
Limestone House 20 Drogheda Street, K32 FN34, Balbriggan, Dublin
44 Potterhill Perth, PH2 7EA
Holbergs gate 19, 0166 Oslo
Estrada da Luz 63, 1600-152 Lisboa
I regularly attend WordPress community meetings - WordUp, WordCamp Poland and WordCamp Europe. Just come and let's talk!
Add WP CalendarCan't find an answer? Email us at hello@wppoland.com
We begin with a free consultation where we define your business goals, technical requirements, and delivery constraints. After that, you receive a clear scope, timeline, and cost breakdown so expectations are aligned from day one. Delivery is handled in short iterations with regular progress updates and decision checkpoints. This keeps the project transparent, reduces risk, and gives you practical control over priorities and budget.
Pricing depends on scope, design depth, integrations, and the level of custom development needed. Details are available on the pricing page, and the final estimate is always based on your specific requirements.
Yes, we provide ongoing maintenance support after launch. It includes WordPress and plugin updates, monitored backups, security checks, and incident response when something breaks. We also handle small continuous improvements so your site evolves instead of freezing after go-live. This approach protects performance, improves stability, and lowers the cost of unexpected downtime.
Project length depends on complexity, content readiness, and third-party integrations. A simple landing page is typically delivered in 1-2 weeks, a business site with performance optimisation usually takes 3-6 weeks, and e-commerce projects often need 6-12 weeks. We split the timeline into clear milestones so you always know what is being built and when reviews happen. If scope changes, we update the plan transparently so deadlines and costs remain predictable.