If you build, maintain, or distribute WordPress plugins or themes in the EU market, there’s a regulation headed your way that’s going to change how you work. The Cyber Resilience Act (CRA) isn’t a suggestion — it’s law. And the clock is ticking.
What Is the CRA?
The Cyber Resilience Act is the EU’s answer to the growing pile of insecure software flooding the market. It sets mandatory cybersecurity requirements for products with digital elements — and yes, that includes WordPress plugins and themes distributed commercially.
Think of it as CE marking for software. If your digital product touches the EU market, it needs to meet baseline security requirements, come with proper documentation, and have a vulnerability handling process in place.
Why WordPress Developers Should Care
Here’s where it gets interesting for our community. The CRA applies to commercial software, which means:
- Premium plugins and themes sold to EU customers are in scope
- Client work where you’re the developer of record could put you on the hook
- SaaS products built on WordPress that serve EU users need compliance
- Open source has a carve-out, but it’s narrower than you think — if you accept donations or offer paid support, the lines get blurry
The Key Requirements
Without drowning you in legalese, here’s what the CRA demands:
- Security by design: No more shipping first and patching later. Security has to be baked in from the start.
- Vulnerability handling: You need a documented process for receiving, triaging, and fixing security reports.
- Software Bill of Materials (SBOM): You’ll need to document every dependency in your product. Yes, every npm package and Composer dependency.
- Ongoing updates: You’re responsible for security updates throughout the product’s expected lifetime.
- Incident reporting: Actively exploited vulnerabilities must be reported to ENISA within 24 hours.
The Timeline
The CRA entered into force in December 2024. The reporting obligations kick in by September 2026, and full compliance is required by December 2027. That sounds like a lot of time until you realize how much process you need to build.
What You Should Do Now
Start with the basics:
- Audit your products — Know what you’re shipping and to whom
- Generate SBOMs — Tools exist to automate this. Start using them.
- Document your security processes — If your vulnerability handling process is “check email sometimes,” that’s not going to cut it
- Review your dependencies — You’re responsible for the security of everything in your supply chain
- Talk to a compliance specialist — The CRA is complex, and getting it wrong carries real penalties
The Silver Lining
Here’s my take: the CRA is actually good for professional WordPress developers. It raises the bar, which means the low-effort, security-negligent competitors get squeezed out. If you’re already following security best practices — proper input sanitization, output escaping, regular dependency audits — you’re halfway there.
The developers who treat this as an opportunity rather than a burden are going to win. Compliance becomes a competitive advantage when your competitors are scrambling to catch up.
Need help getting CRA-ready? Let’s talk about your compliance roadmap.
