The ANSSI’s 10 Commandments for Securing Your CMS
Published on March 27, 2026
The French National Agency for Information Systems Security (ANSSI) is the national authority responsible for supporting and securing the development of digital technologies in France. In other words, it is the benchmark when it comes to monitoring, detection, alerting, and response to cyberattacks. The agency has recently published ten best practices for setting up your future CMS.
Evaluate the available CMS solutions (e.g., WordPress, Wix, Drupal, Joomla) in order to choose one that meets the security criteria outlined in this document (after all, it would be a shame to pick one that doesn’t…).
Enable HTTPS by referring to the configuration examples provided in Appendix B of the TLS Security Recommendations guide.
To go further, implement all the recommendations from the guide. Automated configuration testing tools, such as Mozilla Observatory, can help you achieve state-of-the-art compliance. At Hodi, we explain how to do it here.Limit the use of extensions (plugins) and themes to what is strictly necessary.
Use extensions and themes that are actively maintained and have been validated by the publisher. To go further, follow the recommendations in Chapter 6 of the Recommendations for Implementing a Website guide, which focus on controlling CMS content and components.Implement secure administration best practices, including hardening the administration workstation, minimizing open ports, using secure protocols such as SSH or TLS, using dedicated administrator accounts, and maintaining a strong security posture in line with the Recommendations for Secure Administration of Information Systems guide.
Implement multi-factor authentication (MFA) for the website’s functional administrators. In particular, ensure that the CMS is compatible with recommendations related to the lifecycle of authentication factors, limiting authentication attempts, using non-informative error messages, defining a strong password policy, securely storing passwords, and changing default values. This should be complemented by disabling the CMS’s default user account (which is typically an administrator), in accordance with the Recommendations on Multi-Factor Authentication and Passwords guide.
Back up the website content as well as the CMS configuration (included as standard with your Hodi hosting!).
Implement HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), and secure session cookies, as recommended in the Guidelines for Secure Website Implementation.
Identify and strictly limit the CMS’s interconnection flows with the Internet and the exposure of open ports. Ensure service availability and resilience against denial-of-service (DoS) attacks by following the Recommendations for Connecting an Information System to the Internet. Also, review the applicability of Chapter 4—entirely dedicated to securing access to web-hosted content—to address cases where the CMS retrieves external content.
Collect, analyze, and generate alerts based on CMS logs. Refer to Appendix A of the Architecture Recommendations for Secure Logging Systems to establish a minimal logging baseline, and to Appendix C for an introduction to security incident detection.
Harden the CMS runtime environment by applying the principle of least privilege:
• to the underlying runtime (e.g., PHP Security Guide);
• to database permissions (e.g., PostgreSQL examples);
• to system configuration (included as standard with your Hodi hosting!).That should keep your agencies and web developers busy!
If you need help auditing the security of your current CMS or before deploying a new one, feel free to reach out to our expert team!Original link to the ANSSI recommendations on their official website.
