Under the engineering hood: Why Malwarebytes chose WordPress as its CMS

Malwarebytes explains why it chose WordPress as the backbone of its digital content operations, emphasising modern WordPress’ openness, transparency and ecosystem, alongside a discipline around governance and a mature core security model. In its enterprise-grade DXP, WordPress acts as the content layer with editors drafting once and APIs powering multiple front-ends, delivering a headless pattern that decouples authoring from delivery.

The architecture combines edge-rendered pages, a CDN and a Web Application Firewall, with private networking for the admin plane and strict SSO with MFA to access admin interfaces and APIs, thereby minimising exposure of control endpoints. The approach is reinforced by rigorous plugin governance, including an allowlist and code reviews, plus dependency management with SBOMs and automated CI/CD gates that run SAST and DAST tests.

Open-source transparency, rapid patching via the WordPress security community and the ability to inspect core and plugin code underpin faster remediation and safer updates. Lessons include starting headless from day one, enforcing least-privilege access and maintaining a lean, well-audited plugin ecosystem.