WordPress Service Level Agreement (SLA)

Wake Forest WordPress Team

Revised October 2024

---

General Overview

This document is a Service Level Agreement (SLA) between the Wake Forest University campus community (Clients) and the Wake Forest WordPress Team (WFWP), documenting the shared WordPress (WP) environment that WFWP provides. It outlines the services and levels of support one can expect from WFWP and the responsibility of those using the services.

The Wake Forest WordPress Governance Group (Governance Group) reviews this agreement each year in January.

For any questions or clarifications regarding this SLA, please contact wordpress@wfu.edu and someone from the WordPress Team will be able to answer your questions.

Glossary of Terms in this SLA

Glossary of Terms

AWS (Amazon Web Services): A cloud computing platform that provides a range of services, including storage, servers, and databases. In this SLA, AWS is used to host the WordPress environment.

Backups: Copies of data stored on the server, allowing recovery in case of data loss. Backups in this SLA include databases and media files.

Cloud Hosting: A method of hosting websites or services on virtual servers that access computing resources from a physical network of cloud servers. In this case, AWS provides cloud hosting for WordPress.

DNS (Domain Name System): A system that translates human-friendly domain names (like example.com) into IP addresses that computers use to locate websites.

Elastic File System (EFS): A scalable cloud file storage system provided by AWS that is used for file storage, ensuring data is available and backed up.

Google Analytics (GA4): A tool provided by Google to analyze website traffic and user behavior. GA4 is the latest version of this tool and is used to generate insights for website performance.

LAMP Stack: A set of software technologies used to run websites. LAMP stands for Linux (operating system), Apache (web server), MySQL (database), and PHP (programming language).

Linux: An open-source operating system that forms part of the server infrastructure in this SLA.

Minor and Major Updates: Updates to WordPress, plugins, or other software. Minor updates typically involve security patches or small improvements, while major updates often include significant changes or new features.

MySQL: An open-source database management system used to store and manage data on WordPress websites.

Pingdom: A monitoring tool used to check the uptime and performance of websites. It tracks the availability of the WordPress environment.

PHP: A programming language used to build and maintain WordPress websites.

RDS (Relational Database Service): A cloud database service provided by AWS used to host and manage WordPress databases in a scalable and efficient way.

Revisions: Saved versions of a post or page in WordPress that allow users to revert to previous versions if needed. In this SLA, revisions are limited to the 15 most recent changes.

S3 (Simple Storage Service): A cloud storage service provided by AWS, used to store media files which are uploaded to the media gallery (such as images, PDFs, etc.) for WordPress websites.

Security Patch: A fix for software vulnerabilities that could allow malicious attacks. WordPress security patches are applied regularly to ensure the environment remains secure.

Service Request: A formal request submitted by a Client for assistance or support related to their WordPress website. Requests must be submitted through the Web Request Form.

Site Owner: The person designated as responsible for managing the content and administration of a WordPress website. They ensure compliance with university policies and respond to check-ins regarding continued site use.

Siteimprove: A tool provided to website owners to track website performance, accessibility, and visitor behavior. Training is required to use this tool.

Snapshot: A backup of a system at a specific point in time, used to restore data in case of an issue. In this SLA, AWS takes snapshots of databases and file systems.

Uptime: The percentage of time a service is available and operational. This SLA commits to 99.9% uptime, meaning the WordPress environment should be available almost all the time.

WCAG 2.2 AA Compliance: A set of standards for making web content more accessible to people with disabilities. This level of compliance is mandatory for many organizations and ensures that websites are usable by all individuals.

Web Request Form: The formal method for submitting requests for WordPress support, accessible through a link provided by WFWP.

WordPress Environments

Dev (Development Environment):
The environment where new features, updates, or bug fixes are first created and tested by developers. It is an isolated area where developers can work on code without affecting live websites or end users. Changes made here are not visible to the public.

UAT (User Acceptance Testing Environment):
An environment where clients or stakeholders can test and review new features or updates before they are moved to production. The purpose of UAT is to ensure that the changes meet the necessary requirements and function as expected. It closely mirrors the production environment to ensure accurate testing.

Pre-Production Environment:
A staging environment used for final testing before deploying changes to production. This environment is a replica of the production environment and serves as the last step in the deployment process to ensure everything works as expected. It allows for additional quality assurance checks and helps minimize risks when changes are deployed.

Production Environment:
The live environment where the actual website or application runs and is accessible to the public or end users. This is the final version that users interact with, and any changes made here are immediately visible to site visitors. The production environment is fully operational and critical to business functions, so it requires careful monitoring and maintenance to ensure uptime and stability.

---

Service Description

WFWP offers a shared WordPress environment for departments, organizations, and special interests across Wake Forest University (WFU).

Clients will be given access to their WordPress website with the following pre-configured for them:

• 400 MegaBytes of media storage hosted in Amazon S3
• Cloud hosting provided by Amazon Web Services (AWS)
  • LAMP web stack (Linux, Apache, MySQL Database, PHP)
• Automated backups
• WCAG 2.2 AA compliant WordPress theme
• Industry Standard Enterprise Level Security, Performance, and Stability Practices.

---

Responsibilities

WFWP

• WFWP will review and approve domain names. IS will manage the DNS record.
• WFWP will provide the initial installation of the WordPress website.
• WFWP will regularly perform maintenance updates to PHP, while IS will perform maintenance updates to Linux, Apache, and MySQL. 
• WFWP will follow other best practices to maintain the security of website servers as required by Information Systems (IS) and our hosting provider, Amazon Web Services (AWS).
• WFWP will periodically update Clients’ website functionality via the WordPress Blog and by email through the WordPress Editors Google Group.
• WFWP will provide Clients with updates as needed regarding any incidents resulting in outages via the WordPress Blog and by email through the WordPress Editors Google Group. IS also provides https://status.is.wfu.edu/, which allows status tracking for wfu.edu and other services.
• WFWP will monitor and install any security update to WordPress within one month of release. 
• WFWP will monitor and install minor updates to the WordPress core and associated plugins used on Client websites within one month of their release.
• WFWP will install major updates to the WordPress core within two months of release.
• WFWP will respond to work requests in a prioritized manner as outlined in the Service Request Response and Resolution Times section.
• WFWP will check in annually with clients to ensure websites are still in use. Websites whose owners cannot annually confirm continued use will be removed and archived.
• WFWP will provide clients access to Siteimprove to view website traffic and analyze visitor behavior. If the desired data cannot be obtained through Siteimprove but is available through GA4, access to or reports generated from GA4 (Google Analytics) may be provided as an option. Training is required for Siteimprove before access is granted. The client must request access using the Web Request form, found here.

Client

• Clients are responsible for choosing an appropriate domain name and submitting it for review and approval.
• Clients are responsible for adhering to all of Wake Forest University’s policies, including, but not limited to:
  • Accessibility Guidelines
  • Policy on Responsible and Ethical Use of Computing Resources
  • University Copyright Policy
• Clients are responsible for taking training classes or using the WP support websites and services as needed.
• Clients are responsible for submitting all WordPress support requests through the formal Web Request Form rather than by email, phone call, or other means.
• Executable code: No code copied from third-party vendors or websites shall be added to the Client’s website unless WFWP has approved the code.
• Clients must not make unauthorized changes to their website’s global header or footer (using Javascript, CSS, or other methods). 
• Sensitive or confidential data: No sensitive or confidential data, including, but not limited to, Social Security numbers, credit card information, or other personally identifiable information, shall be stored in or transmitted through WordPress.
• Clients are responsible for maintaining a Site Owner accountable for the website’s content.
• Unless otherwise agreed to, clients are responsible for managing and maintaining the content of their websites. “Content” includes text, images and PDFs.
  • WFWP maintains the right to change content without affecting its meaning without notifying the Client. (Examples: misspelling, formatting, etc.)
  • WFWP reserves the right to change the meaning of content in rare circumstances and will notify the Client when such changes are necessary.
• Clients must respond to WFWP’s annual check-in to confirm continued website use. WFWP will remove and archive the site if no response is provided within 30 days.
• Clients must only accept payments through a tool approved by WFU Financial Services.
• Clients must consult with WFWP before using the website to raise funds due to requirements related to website security when transactions occur.
• Clients must consult with WFU Financial Services for any items or services for sale. 

---

Plugin Subscriptions and Other Fees

WFWP

• WFWP will maintain and pay the subscription and other fees for approved plugins that require them. 

Client

• Clients may not maintain subscription fees for plugins. 
• Clients may not purchase a plugin and provide it for installation. All plugin installation requests must follow the plugin evaluation procedure. If a plugin is accepted for adoption and requires a purchase or subscription, WFWP will pay for and manage that purchase and/or subscription.

---

Outside the Scope of This Agreement

WFWP

• All WordPress plugins and themes undergo an extensive review before being approved for installation in the WordPress environment. WFWP will not provide plugin or theme installations on a per-site basis. The Wake Forest WordPress team and the WordPress Governance Group will evaluate all plugin requests. Due to the nature of our organization, WordPress theme installation requests are not accepted.
• WFWP will not provide per-site child theme development, access to the WordPress API, or direct code-level file access.
• WFWP will not provide custom web application/database development beyond the provided WordPress plugins and themes. If custom development – beyond the scope of WFWP support/capabilities – is required for University business purposes and is approved by the Governance group, WFWP will engage the requesting business partner to define expectations, scope the project, create pricing guidance (funded by the requesting business partner), and plan the work effort.  

These guidelines apply to most situations in order to provide a stable, secure, maintainable, and performant environment. The Wake Forest WordPress Team and the WordPress Governance Group will consider outliers and special circumstances on a case-by-case basis. 

---

Service Commitment

Service Availability

The WFWP environment is available 24 hours a day, 365 days a year, with a target uptime of 99.9% (8,756.25 of 8,765 hours). Regularly scheduled maintenance windows may result in downtime and will be announced in advance to the Client using the WordPress Blog and by email through the WordPress Editors Google Group.

Incidents

In the event of an incident that disrupts WordPress functionality, WFWP and IS are committed to immediate coordination to resolve the issue. Our incident response involves promptly addressing any outage or service degradation until the issue is resolved.

Metrics & Reporting

This section outlines how WFWP will measure and report each commitment made in this SLA:

• As soon as possible after each SLA-impacting event is resolved, the Service Owner (WFWP) will communicate via the WordPress Blog and by email through the WordPress Editors information detailing the duration of the event, the reason for the event, the resolution of the event and the volume of customers impacted by the event. 
• The total downtime will be determined using the third-party Pingdom service. WordPress uptime is reviewed every quarter. 

---

Service Requests

Please use the Web Request Form for service requests. Individuals making service requests via phone, email, or other methods will be redirected to the Web Request Form so that requests can be appropriately processed, tracked, and completed.

Standard business hours for service requests are between 8:30 a.m.–5 p.m., Monday through Friday, excluding University holidays.

Service Request Response and Resolution Times

For service requests, WFWP aims to provide efficient and timely responses to meet your needs. When a service request is submitted using the Web Request Form, our target response time is within two business days. This ensures that your request is acknowledged and initial steps are taken to promptly address the issue or fulfill the request.

Resolution times for service requests may vary based on their complexity. We strive to achieve resolution within five business days for straightforward requests that do not involve code development or deployment. However, the resolution time can extend from 10 business days to multiple months for more intricate requests, especially those involving code development or deployment. Rest assured, we will communicate estimated timelines as requests are evaluated.

---

Maintenance 

WFWP 

The WFWP environment will adhere to the following maintenance schedule:

• WordPress security patches and minor versions will be applied within one month of their release.
• WordPress major versions will be applied within two months of release.
• As recommended by AWS and WFU IS, PHP upgrades will be applied by the end of September (FY Q1) of each year.
• Plugin updates will be applied on a bi-weekly basis.
• Any other emergency maintenance will be applied as needed. Any maintenance resulting in downtime will be communicated beforehand via the WordPress Blog and by email through the WordPress Editors Google Group.

---

Client

The Client is responsible for maintaining the following:

• A Site Owner must always be established with WFWP. If the primary Site Owner leaves the University, a new Site Owner must be established within 30 days of their departure.
  • Site Owners can add or transfer their responsibilities in the Site Options section of their website, as noted in the Managing Users section of the WordPress guide.
• The Site Owner is responsible for removing users’ access from their WordPress website when the user leaves the department or University within 30 days of their departure.
• The Site Owner must respond to WFWP’s annual check-in to confirm continued use of their website. If no response is provided within 30 days, the website will be removed and archived as outlined below.
• The Site Owner is responsible for ensuring their site adheres to the Client Responsibilities outlined in this document.

Archive Process

1. Site Owners will be notified that they have 30 days to respond to WFWP’s inquiry before their site is archived.
2. If no response is received within the first five business days, a second email will be sent to the Site Owner requesting a response. 
3. If no response is received within the first 15 days, all users with Administrator privileges will be emailed together requesting a response. 
4. If no response is received within five business days of the email to all Administrators, all Editors will be copied on the follow-up email.
5. If no response is received within 30 days from the Site Owner, Administrators, or Editors, the site will be backed up and archived and public access to it will be cut off. 
6. Clients may reach out to WFWP and have their sites restored.

---