Our approach to security
The problem isn’t WordPress itself — it’s running it without a team that keeps it updated. Onesoft protects you with an architecture that reduces points of attack, and the same engineers who built it looking after it.
Does your website’s URL start with “http://”?
Missing a single “s” means the connection is not encrypted — everything is sent in plain view. And since October 2026, Google Chrome warns visitors before opening such sites. Many company websites in our region still use “http://”.
Visitors see a warning screen first
Starting with Chrome 154 (October 2026), Chrome asks for confirmation by default before the first visit to any public site without HTTPS. Your customers are told the connection isn’t secure before they ever see your home page.
Passwords and personal data can be intercepted
Unencrypted traffic can be read by anyone on the same network path — free Wi-Fi in cafés and hotels, for example. Admin passwords and the names, phone numbers and emails typed into your contact form travel in plain text.
Pages can be altered
Content can be tampered with in transit, and visitors can’t tell. Fake input fields or malicious ads and links can be injected — and used for fraud under your company’s name.
Lower search visibility
Since 2014, Google has used HTTPS as one of its ranking signals. All else equal, encrypted sites have the edge — even more so when a warning screen drives visitors away.
“Not secure” costs you trust
The address bar shows “Not secure”. Partners, customers and job applicants see it and quietly leave.
Legal responsibility
Japan’s Act on the Protection of Personal Information requires businesses to take security measures for personal data. Receiving inquiries without encryption may be seen as a failure to do so.
Check it in 10 seconds
- Open your website in a browser on a PC or smartphone
- Check that the URL starts with “https://” and shows a padlock
- If you see “Not secure”, you need to act now
The fix isn’t difficult
Install an SSL/TLS certificate and automatically redirect http:// to https:// — in most cases this can be done without rebuilding your site. Onesoft also takes on HTTPS migration on its own.
Sources: Google “HTTPS by default” (“Always Use Secure Connections” on by default from Chrome 154); Google Search Central Blog “HTTPS as a ranking signal” (Aug 2014)
Data breaches and defacement are not someone else’s problem
Personal data leaked through unauthorized access, operations halted by ransomware, websites defaced — reports keep coming, for companies and local governments of every size. In July 2026, Japan’s IPA (Information-technology Promotion Agency) also issued an alert about WordPress vulnerabilities.
Most attacks are automated: bots search for weak sites and break in mechanically. Being small doesn’t keep you safe — small sites without time for updates and monitoring are often the slowest to notice they’ve been breached.
WordPress by the numbers
Sources: Patchstack “State of WordPress Security in 2026” (Feb 2026); W3Techs (as of Sept 2026)
Common patterns of neglect
Plugins never updated
Plugin updates fall outside the maintenance contract, so nobody does them.
Lost in handover
Admin accounts and update procedures stay with a former staff member or agency.
Admin panel open to anyone
The login page is exposed to the internet and targeted by brute-force attacks.
No way to recover
Without backups or activity logs, you can’t restore a defaced site or find the cause.
When a site is defaced or data leaks, the impact on users — and the responsibility to explain — stays with the site owner.
WordPress itself is not the problem. Kept updated and monitored, it can be used safely. The issue is running it without a team that keeps doing that.
How Onesoft builds
Compared with a typical WordPress setup, the number of entry points for attackers is very different.
What we do
Static delivery, fewer entry points
Public pages are pre-built HTML; no program or database runs on each page view.
No third-party plugins
We build the features ourselves and keep libraries to ones we can track and update.
Strict limits in the browser
CSP (only approved scripts may run), HSTS (always encrypted) and other browser-side defenses.
Data in Japan, with permissions and logs
Where needed, data is stored in AWS Japan regions with audit logs of who did what.
Documented operations
Following national guidelines for local-government information security, we document permissions, logs and procedures.
Built and maintained by the same people
The developer who knows the system handles maintenance and responds quickly to new vulnerabilities.
This website follows the same principles
- Every page is served as a static file — no program or database runs on the server
- A strict CSP that only allows scripts whose hashes were computed for each page
- HSTS to force HTTPS, plus headers against clickjacking and MIME sniffing
- Fonts served from our own server — no unnecessary third-party requests
- Inquiries go through Google Forms; this site stores no personal information
Check these points on your own site
- When were WordPress core, theme and plugins last updated?
- Are unused plugins or admin accounts of former staff still there?
- Is the admin panel (e.g. /wp-admin) reachable by anyone?
- Are update procedures and admin credentials handed over when staff change?
- Have you ever actually restored the site from a backup?
- Do you know where submissions from your contact form are stored?
Let us review or migrate your current site
Tell us how your site is built and run today. We’ll propose the measures you need, or a migration to a safer architecture. Questions about WordPress updates and maintenance alone are welcome too.
Free consultation