Chile's Cybersecurity Framework Law (21.663) created the National Cybersecurity Agency, which has been operating since January 2025. Its main obligations, such as reporting incidents and meeting minimum standards, are for essential services and operators of vital importance: energy, telecom, health and banking, among others.
If you run a small business or a brand, that law most likely does not apply to you directly. But Law 21.719 on personal data does require you to protect the data you collect and to report leaks. And most of that data goes through your website.
Where problems get into WordPress
In my experience it is almost never WordPress core. It is usually something on this list:
- Outdated plugins or themes, or ones downloaded from unofficial sites.
- Admin users who no longer work with you and are still active.
- Passwords shared by email or chat.
- Backups stored on the same server as the site, or no backups at all.
- Forms that store data where nobody knows.
The basics I recommend
- Update WordPress and plugins often, testing on a copy first.
- Keep only the plugins you actually use.
- Review users regularly and give each person the least access they need.
- Turn on two step verification for admins.
- Automatic backups stored off the server, and check now and then that they restore.
- Know what to do if something happens: who reports, to whom and how to restore.
None of this is expensive or complicated, though it is hard to keep up. That is what a maintenance plan is for.
