I wrote my first production web applications as a Marine. As a 4067 Computer Programmer at Camp Lejeune, I built an armory management system that tracked weapons across the base's armories, and during Operation Iraqi Freedom I developed and deployed a secure logistics application the Marine Logistics Command used to track Marines, supplies, ammunition, vehicles and equipment. That experience taught me two things that still drive how AlphaWeb builds for government: the people using the system have no time to fight it, and the data has to be protected.
On the public web, those two lessons translate to accessibility and security.
Section 508 and WCAG in plain English
Section 508 of the Rehabilitation Act requires federal agencies to make their information and communication technology accessible to people with disabilities. The current Section 508 standards incorporate the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA by reference. Many state and local governments and schools are held to WCAG as well, and newer versions of WCAG (2.1 and 2.2) add criteria for mobile and low vision users. Our practical advice: build to the newest WCAG version at Level AA, and you will meet or exceed what most contracts ask for. Always confirm the exact standard in your contract or policy.
WCAG is organized around four principles. Content must be:
- Perceivable: text alternatives for images, captions for video, enough color contrast.
- Operable: everything works with a keyboard, users have enough time, nothing flashes dangerously.
- Understandable: clear language, predictable navigation, helpful form errors.
- Robust: valid, semantic markup that works with assistive technology.
Where WordPress helps
WordPress core has an accessibility team and accessibility coding standards, and the block editor produces semantic headings, lists, tables and images with alt text fields. That gives you a good foundation. Where sites usually fail is everything layered on top:
- Themes with low contrast colors, missing focus outlines or menus that only work with a mouse.
- Page builder output with heavy, nested markup and headings chosen for looks instead of structure.
- Plugins like sliders, popups and forms that trap keyboard focus.
- Content like scanned PDFs, images of text, and videos without captions.
That is one reason we are rebuilding sites, including our own, on native WordPress blocks. Less markup and fewer moving parts make accessibility easier to get right and keep right.
Our accessibility checklist
On every public sector build, we:
- Choose or build a theme tested with keyboard only navigation and a screen reader.
- Check color contrast for every text and background pairing in the design system.
- Enforce one H1 per page and a logical heading order.
- Require alt text in the editorial workflow and train editors on writing it.
- Make forms accessible, with labels, clear errors and no CAPTCHA that blocks assistive tech.
- Caption video and provide transcripts for audio.
- Run automated scans, then do manual testing, because automated tools catch only part of the problem.
- Audit again after launch, since new content is where regressions happen.
Security for government WordPress
WordPress powers plenty of high profile sites, and it can be run securely. The basics matter most:
- Keep core, themes and plugins updated, and remove anything unused.
- Limit plugins to well maintained ones with a clear security track record.
- Enforce strong authentication, including two factor for every admin and editor, and SSO where the agency has an identity provider.
- Least privilege roles. Most editors do not need administrator access.
- Harden the host: managed hosting, a web application firewall, file integrity monitoring, and backups stored off the server.
- Monitor uptime, logins and file changes, with a plan for who responds.
In "Building Web Apps with WordPress," Jason Coleman and I devoted a full chapter to securing WordPress, because it is the part of a project that never ends at launch. Our support plans are built around the same cycle: audit, update, secure, optimize, extend, scale and monitor.
Veteran owned, mission focused
AlphaWeb is a U.S. veteran owned business. We understand that for an agency or a unit, a website is not a marketing project. It is how people get information they rely on. If you need an accessible, secure WordPress site or app for a government or military program, brief us on your mission.
Related Reading
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
