In this guide (6)
- 1Why a law firm's CMS is not a trivial choice
- 2The technical requirements a CMS for law firms must meet
- 3The GDPR issue: what a law firm actually risks
- 4Performance: why it matters for a law firm too
- 5What a law firm's website should do — and what it often doesn't
- 6The hidden link between security and professional reputation
The website of a law firm is not the same as that of a real estate agency or a construction company.
Anyone who gets in touch with a law firm through an online form is sharing information that in many cases falls into the categories of special data under the GDPR: legal situations, litigation, employment relationships, family matters. This is not data you can handle with technical superficiality.
And yet most Italian law firm websites run on WordPress with a theme bought on Themeforest and a form plugin that has never seen a data protection impact assessment.
This article is not meant to convince you to use KeideaCMS. It is meant to help you understand what the CMS managing your firm's website should do — technically and legally. Then you decide.
Why a law firm's CMS is not a trivial choice
A lawyer who receives a consultation request through the form on their website is collecting personal data. Often sensitive data. This is not a minor detail: it is an obligation arising from Article 9 of the GDPR, which requires specific technical measures for the processing of these categories of data.
The problem is that most general-purpose CMS platforms — WordPress above all — are not built with this kind of requirement in mind. Security is left to third-party plugins, the encryption of data transmitted by forms depends on the hosting configuration, and access log management is often non-existent or not configured.
In practice: the website manages clients' sensitive data with an infrastructure that was never designed to do so.
The technical requirements a CMS for law firms must meet
1. Data encryption in contact forms
Every time a potential client fills out a form on the website — even just with first name, last name and a line describing their problem — that data is transmitted to the server. The question is: how is it transmitted and how is it stored?
Transmission over HTTPS is the bare minimum — and fortunately it is now almost universal. But storage is another matter. On WordPress, form data is often saved in plain text in the database by most plugins (Contact Form 7, WPForms, Gravity Forms in their standard configuration). Anyone who accesses the database — a compromised shared hosting account, an unprotected backup, an external developer with access to the panel — can read those communications.
A CMS designed to handle sensitive data encrypts the data in the database. KeideaCMS uses AES-256 encryption on form data — the same standard used in banking. It's not an option to be enabled: it's built into the core.
2. Admin panel separate from the public infrastructure
On WordPress, the admin panel is reachable from any browser at /wp-admin. It is publicly accessible, known to every attacker, and automatically targeted by scanners looking for vulnerable versions every day.
A CMS for legal professionals should have the admin panel separated from the public environment — on a separate subdomain, with access restricted to specific IPs, protected by two-factor authentication. Not as an option, but as a default requirement.
3. Native WAF and SQL injection protection
SQL injection attacks allow an attacker to extract data directly from a website's database. If the database contains the firm's client communications, the damage is twofold: a personal data breach (with a mandatory notification to the Data Protection Authority within 72 hours) and a potential breach of professional confidentiality.
A Web Application Firewall built into the CMS core — not added as a plugin — intercepts these requests before they reach the database. The difference between a native WAF and a WAF plugin is substantial: the plugin operates on top of a system whose structure remains accessible, while the native WAF is part of the architecture itself.
4. Access logs and change monitoring
The GDPR requires that the data controller be able to demonstrate the measures taken to protect data. This includes the ability to track who accessed what and when. A system logging access to the admin panel — with timestamp, IP and user — is an accountability requirement, not just a technical security one.
On WordPress, this functionality does not exist by default. There are plugins that add it, but they also add an additional attack surface and depend on the quality of the developer maintaining them.
5. Updates managed without manual intervention
Every update not applied on WordPress is a potential vulnerability. The problem for law firms is that updates require technical intervention, testing, and sometimes cause incompatibilities with the theme or other plugins. The practical result is that many websites remain on outdated versions for months.
A managed CMS — where updates are applied by the team that built the system, with guaranteed testing and no risk of breakage — eliminates this risk structurally.
The GDPR issue: what a law firm actually risks
Lawyers are subject to the GDPR just like any other data controller. In fact, in many cases they process special categories of data — judicial data, or data relating to health, sexual life, or religious beliefs of clients — which require reinforced protection measures.
Fines from the Data Protection Authority for personal data security breaches can reach up to €20 million or 4% of global annual turnover. But beyond the financial penalties, a data breach involving a law firm's clients has consequences for professional reputation that are difficult to quantify.
What many don't know is that liability does not only apply to cases where data is actually stolen. The Data Protection Authority can also sanction the mere adoption of inadequate technical measures — even if a breach has not yet occurred. A website with a form that doesn't encrypt data in the database is already technically non-compliant, regardless of whether it has ever been attacked.
The Data Protection Impact Assessment (DPIA)
For high-risk data processing — which includes judicial data and the special categories handled by many law firms — the GDPR requires a DPIA, a preliminary data protection impact assessment. Part of this assessment concerns the technical measures adopted by the IT infrastructure, including the website.
A CMS with documented data encryption, integrated WAF, access logs and managed updates is far more defensible in a DPIA than a WordPress site with various plugins whose security policy isn't even known.
Performance: why it matters for a law firm too
There's a widespread perception in legal professional circles: the site needs to be "dignified", not fast. This is a mistaken idea.
Loading speed is a Google ranking factor. A slow site — with an LCP above 2.5 seconds — is penalized in organic search compared to faster sites. This means less visibility in searches for "lawyer [city]", "law firm [specialization]", "legal advice [area]".
Then there's the user factor. A potential client who lands on a firm's website and waits 4 seconds to see the page won't wait: they go back and click on the next result. The bounce rate increases exponentially with loading time — every extra second costs real clients.
WordPress sites with premium themes and multiple plugins rarely achieve PageSpeed scores above 70 on mobile. KeideaCMS keeps TTFB below 200ms and Core Web Vitals scores in the green structurally, not through hacks or compromises on content.
What a law firm's website should do — and what it often doesn't
Beyond security and compliance, there's the question of what a law firm's website must communicate, and how.
Potential clients searching for a law firm online mainly evaluate three things: specialization (which area of law you work in), credibility (who you are, what results you've achieved), and ease of contact (how simple it is to request an initial consultation).
Many Italian law firm websites fail on all three fronts: they have a generic "Services" area listing every conceivable area of law, an "About Us" section with formal photos and plain-text résumés, and a contact form that goes who knows where.
A CMS that allows the site team to update content, add anonymized case studies, publish articles on current legal topics of interest — without depending on a developer every time — is a tool that generates ongoing value, not a static showcase.
The hidden link between security and professional reputation
There's an aspect that's rarely discussed openly: the security of a law firm's website isn't just a technical or compliance issue. It's a matter of professional reputation.
If the firm's website is compromised — if an attacker installs malware, if form data is exfiltrated, if the homepage is replaced with unrelated content — the damage isn't measured only in fines or restoration costs. It's measured in the trust of clients who shared confidential information through that channel.
For a lawyer, confidentiality isn't optional: it's the foundation of the professional relationship. The digital infrastructure must reflect this value, not contradict it.
If you want to concretely assess the state of your current site — security, GDPR compliance, performance — you can request a free audit. We analyze the infrastructure and provide you with a report on the concrete issues, with no obligation.
