WordPress Service Level Agreement (SLA)

Wake Forest WordPress Team

Revised August 2024

---

General Overview

This document is a Service Level Agreement (SLA) between the Wake Forest University campus community (Clients) and the Wake Forest WordPress Team (WFWP), documenting the shared WordPress (WP) environment that WFWP provides. It outlines the services and levels of support one can expect from WFWP and the responsibility of those using the services.

The Wake Forest WordPress Governance Group (Governance Group) reviews this agreement each year in January.

---

Service Description

WFWP offers a shared WordPress environment for departments, organizations, and special interests across Wake Forest University (WFU).

Clients will be given access to their WordPress website with the following pre-configured for them:

• 400 MegaBytes of media storage hosted in Amazon S3
• Cloud hosting provided by Amazon Web Services (AWS)
  • LAMP web stack (Linux, Apache, MySQL Database, PHP)
• Automated backups
• WCAG 2.2 AA compliant WordPress theme
• Industry Standard Enterprise Level Security, Performance, and Stability Practices.

---

Responsibilities

WFWP

• WFWP will review and approve domain names. IS will manage the DNS record.
• WFWP will provide the initial installation of the WordPress website.
• WFWP will regularly perform maintenance updates to PHP, while IS will perform maintenance updates to Linux, Apache, and MySQL. 
• WFWP will follow other best practices to maintain the security of website servers as required by Information Systems (IS) and our hosting provider, Amazon Web Services (AWS).
• WFWP will periodically update Clients’ website functionality via the WordPress Blog and by email through the WordPress Editors Google Group.
• WFWP will provide Clients with updates as needed regarding any incidents resulting in outages via the WordPress Blog and by email through the WordPress Editors Google Group. IS also provides https://status.is.wfu.edu/, which allows status tracking for wfu.edu and other services.
• WFWP will monitor and install any security update to WordPress within one month of release. 
• WFWP will monitor and install minor updates to the WordPress core and associated plugins used on Client websites within one month of their release.
• WFWP will install major updates to the WordPress core within two months of release.
• WFWP will respond to work requests in a prioritized manner as outlined in the Service Request Response and Resolution Times section.
• WFWP will check in annually with clients to ensure websites are still in use. Websites whose owners cannot annually confirm continued use will be removed and archived.
• WFWP will provide clients access to Siteimprove to view website traffic and analyze visitor behavior. If the desired data cannot be obtained through Siteimprove but is available through GA4, access to or reports generated from GA4 (Google Analytics) may be provided as an option. Training is required for Siteimprove before access is granted. The client must request access using the Web Request form, found here.

Client

• Clients are responsible for choosing an appropriate domain name and submitting it for review and approval.
• Clients are responsible for adhering to all of Wake Forest University’s policies, including, but not limited to:
  • Accessibility Guidelines
  • Policy on Responsible and Ethical Use of Computing Resources
  • University Copyright Policy
• Clients are responsible for taking training classes or using the WP support websites and services as needed.
• Clients are responsible for submitting all WordPress support requests through the formal Web Request Form rather than by email, phone call, or other means.
• Executable code: No code copied from third-party vendors or websites shall be added to the Client’s website unless WFWP has approved the code.
• Clients must not make unauthorized changes to their website’s global header or footer (using Javascript, CSS, or other methods). 
• Sensitive or confidential data: No sensitive or confidential data, including, but not limited to, Social Security numbers, credit card information, or other personally identifiable information, shall be stored in or transmitted through WordPress.
• Clients are responsible for maintaining a Site Owner accountable for the website’s content.
• Unless otherwise agreed to, clients are responsible for managing and maintaining the content of their websites. “Content” includes text, images and PDFs.
  • WFWP maintains the right to change content without affecting its meaning without notifying the Client. (Examples: misspelling, formatting, etc.)
  • WFWP reserves the right to change the meaning of content in rare circumstances and will notify the Client when such changes are necessary.
• Clients must respond to WFWP’s annual check-in to confirm continued website use. WFWP will remove and archive the site if no response is provided within 30 days.
• Clients must only accept payments through a tool approved by WFU Financial Services.
• Clients must consult with WFWP before using the website to raise funds due to requirements related to website security when transactions occur.
• Clients must consult with WFU Financial Services for any items or services for sale. 

---

Plugin Subscriptions and Other Fees

WFWP

• WFWP will maintain and pay the subscription and other fees for approved plugins that require them. 

Client

• Clients may not maintain subscription fees for plugins. 
• Clients may not purchase a plugin and provide it for installation. All plugin installation requests must follow the plugin evaluation procedure. If a plugin is accepted for adoption and requires a purchase or subscription, WFWP will pay for and manage that purchase and/or subscription.

---

Outside the Scope of This Agreement

WFWP

• All WordPress plugins and themes undergo an extensive review before being approved for installation in the WordPress environment. WFWP will not provide plugin or theme installations on a per-site basis. The Wake Forest WordPress team and the WordPress Governance Group will evaluate all plugin requests. Due to the nature of our organization, WordPress theme installation requests are not accepted.
• WFWP will not provide per-site child theme development, access to the WordPress API, or direct code-level file access.
• WFWP will not provide custom web application/database development beyond the provided WordPress plugins and themes. If custom development – beyond the scope of WFWP support/capabilities – is required for University business purposes and is approved by the Governance group, WFWP will engage the requesting business partner to define expectations, scope the project, create pricing guidance (funded by the requesting business partner), and plan the work effort.  

These guidelines apply to most situations in order to provide a stable, secure, maintainable, and performant environment. The Wake Forest WordPress Team and the WordPress Governance Group will consider outliers and special circumstances on a case-by-case basis. 

---

Service Commitment

Service Availability

The WFWP environment is available 24 hours a day, 365 days a year, with a target uptime of 99.9% (8,756.25 of 8,765 hours). Regularly scheduled maintenance windows may result in downtime and will be announced in advance to the Client using the WordPress Blog and by email through the WordPress Editors Google Group.

Incidents

In the event of an incident that disrupts WordPress functionality, WFWP and IS are committed to immediate coordination to resolve the issue. Our incident response involves promptly addressing any outage or service degradation until the issue is resolved.

Metrics & Reporting

This section outlines how WFWP will measure and report each commitment made in this SLA:

• As soon as possible after each SLA-impacting event is resolved, the Service Owner (WFWP) will communicate via the WordPress Blog and by email through the WordPress Editors information detailing the duration of the event, the reason for the event, the resolution of the event and the volume of customers impacted by the event. 
• The total downtime will be determined using the third-party Pingdom service. WordPress uptime is reviewed every quarter. 

---

Service Requests

Please use the Web Request Form for service requests. Individuals making service requests via phone, email, or other methods will be redirected to the Web Request Form so that requests can be appropriately processed, tracked, and completed.

Standard business hours for service requests are between 8:30 a.m.–5 p.m., Monday through Friday, excluding University holidays.

Service Request Response and Resolution Times

For service requests, WFWP aims to provide efficient and timely responses to meet your needs. When a service request is submitted using the Web Request Form, our target response time is within two business days. This ensures that your request is acknowledged and initial steps are taken to promptly address the issue or fulfill the request.

Resolution times for service requests may vary based on their complexity. We strive to achieve resolution within five business days for straightforward requests that do not involve code development or deployment. However, the resolution time can extend from 10 business days to multiple months for more intricate requests, especially those involving code development or deployment. Rest assured, we will communicate estimated timelines as requests are evaluated.

---

Maintenance 

WFWP 

The WFWP environment will adhere to the following maintenance schedule:

• WordPress security patches and minor versions will be applied within one month of their release.
• WordPress major versions will be applied within two months of release.
• As recommended by AWS and WFU IS, PHP upgrades will be applied by the end of September (FY Q1) of each year.
• Plugin updates will be applied on a bi-weekly basis.
• Any other emergency maintenance will be applied as needed. Any maintenance resulting in downtime will be communicated beforehand via the WordPress Blog and by email through the WordPress Editors Google Group.

---

Client

The Client is responsible for maintaining the following:

• A Site Owner must always be established with WFWP. If the primary Site Owner leaves the University, a new Site Owner must be established within 30 days of their departure.
  • Site Owners can add or transfer their responsibilities in the Site Options section of their website, as noted in the Managing Users section of the WordPress guide.
• The Site Owner is responsible for removing users’ access from their WordPress website when the user leaves the department or University within 30 days of their departure.
• The Site Owner must respond to WFWP’s annual check-in to confirm continued use of their website. If no response is provided within 30 days, the website will be removed and archived as outlined below.
• The Site Owner is responsible for ensuring their site adheres to the Client Responsibilities outlined in this document.

Archive Process

1. Site Owners will be notified that they have 30 days to respond to WFWP’s inquiry before their site is archived.
2. If no response is received within the first five business days, a second email will be sent to the Site Owner requesting a response. 
3. If no response is received within the first 15 days, all users with Administrator privileges will be emailed together requesting a response. 
4. If no response is received within five business days of the email to all Administrators, all Editors will be copied on the follow-up email.
5. If no response is received within 30 days from the Site Owner, Administrators, or Editors, the site will be backed up and archived and public access to it will be cut off. 
6. Clients may reach out to WFWP and have their sites restored.

---