WordPress as an Intranet

Yes, WordPress works as an intranet for small and mid-sized teams: for internal news, how-tos, a handbook, contacts and forms. Today such an intranet usually runs as a hosted WordPress installation behind a login wall, with user roles, protected files and a second login factor or Microsoft 365 sign-in. A server that can only be reached from the office network is the exception. It makes sense when data must not leave the company network.

I revised this article in October 2026. The first version from 2023 showed, as its main route, an XAMPP installation on a workstation that is shared across the network, with the database user “root” and no password. That is fine for a test on your own computer, but not for a company intranet. The XAMPP guide is still further down, explicitly as a test environment.

Intranet or extranet

An intranet is only for your own people: everyone who works in the company logs in and finds internal news, documents and processes there. An extranet opens part of it to selected outsiders, such as customers, suppliers or partners, who each see only their own area. In WordPress, both are technically the same thing: a website behind a login, where user roles decide who sees what.

What WordPress is good at as an intranet, and what it is not

WordPress plays to its strengths when the intranet mainly distributes content. The editors often know the editor from the company website already, posts and pages are enough for news and a handbook, and the roles administrator, editor, author and subscriber are built in. You decide where the data lives, and there is no per-user fee.

WordPress fits less well when the intranet is mainly meant to manage files, with versions, approvals and permissions per folder. WordPress is not built for that. Even the developers of the All-In-One Intranet plugin write that WordPress was made for public websites and that access control has to be added. If your team already works with Microsoft 365 and mostly shares documents, SharePoint is usually the shorter route. WordPress can then be the front end for news and knowledge, while the documents stay in SharePoint.

Two routes: hosted behind a login wall or office network only

	Hosted behind a login wall	Server on the office network only
Access	From anywhere after login, including from home	Only in the office or via a VPN
Security	The login page can be reached from the internet, so a second factor and updates are a must	Not reachable from outside, but updates are easily forgotten
Updates and backups	As with any website, backups often through the host	The server still needs internet access for updates, and you organise backups yourself
Risk of downtime	The host's data centre	One machine in the office: power, hardware, cover during holidays
Running costs	Hosting contract and upkeep	Hardware, power and time for administration

In most cases I recommend the hosted route. A server in the office only protects you as long as someone looks after it, and that is exactly the work that gets left undone. I would only set up a local server if a requirement says the data must not leave the company network, and then as a proper server with its own database user, HTTPS and backups, not as XAMPP on a workstation.

How to secure a WordPress intranet

Put the whole site behind the login

The All-In-One Intranet plugin makes the entire site private with one checkbox: anyone who is not logged in is sent to the login page. According to the plugin description, it also blocks the REST API for visitors who are not logged in, switches off XML-RPC, keeps search engines out via robots.txt and logs users out after a configurable idle time. As of 21 October 2026 it is at version 1.10.0 and in use on more than 3,000 sites.

Also switch off “Anyone can register” under Settings, General. The plugin warns you when open registration is on, but you have to switch it off yourself.

Files: the gap almost everyone overlooks

A login wall protects pages and posts, but not the files in the media library. An uploaded PDF stays reachable at its direct address, even without logging in. The All-In-One Intranet FAQ says so itself: WordPress serves media files directly through the web server, bypassing PHP and plugins.

For contracts, salary tables or HR documents you therefore need a separate solution: a server rule that only lets requests to the uploads folder through after a login check, or a download protection plugin. With plugins, check exactly who can still access the files afterwards. With Prevent Direct Access, for example, only administrators and the person who uploaded a protected file can open it directly. For documents the whole team should read, that is too narrow. Test the protection yourself at the end: copy the file address and open it in a private browser window without logging in.

Sign-in with a second factor or via Microsoft

With a hosted intranet, the login page can be reached from the internet, and a password alone is not enough there. The Two Factor plugin adds a second login step to WordPress and runs on more than 100,000 sites. According to its description, All-In-One Intranet works with it without extra settings.

If your team works with Microsoft 365, signing in with Microsoft is more convenient. The WPO365 plugin connects WordPress to Microsoft Entra ID (formerly Azure AD): anyone who signs in with their Microsoft account for the first time is created as a WordPress user automatically, and a dedicated intranet mode puts all pages behind the login. Microsoft sign-in is included in the free version, further features are available as paid extensions. The everyday benefit: you manage access in one place, in Microsoft.

Roles, updates and backups

Give everyone only the permissions they need. In an intranet most users are readers, that is subscribers, a few maintain content as editors, and there are two administrators, not ten. For custom roles such as “HR” there is the free Members plugin.

What gets left undone most often in intranets is updates and backups. A website that only your own team sees does not attract attention until something happens. It needs the same updates as any public website, checked on a test copy first, and daily backups on a different server. How fast this has to happen was shown in October 2026 by the PHP2Shell vulnerability, when PHP on the server had to be updated the same day. What maintenance includes and what it costs on the market is covered in WordPress maintenance: costs, services and who handles it. If you would rather hand over the upkeep: that is the core of my WordPress support.

GDPR, hosting in the EU and the works council

An intranet contains personal data: names, departments, phone numbers, often photos. This is not legal advice, but these three points belong before the launch. The last one is German law and applies to companies in Germany:

1. Hosting in the EU, with a data processing agreement. Anyone who processes personal data on your behalf does so on the basis of such a contract under Art. 28 GDPR.
2. Only the profile data the intranet really needs. Check plugins that send data to services outside the EU, for fonts, statistics or chat, before you install them.
3. Involve the works council early if there is one. Under section 87(1) no. 6 of the German Works Constitution Act (English translation), it has a say in technical devices designed to monitor the behaviour or performance of employees. An intranet that logs who read what and when can fall under this.

Which theme and which plugins you need

For a simple intranet with news and a handbook, a normal, well-maintained theme plus the plugins above is enough. A dedicated intranet theme is worth it if you want profiles, groups and activity like in a social network.

Woffice is such a complete package: an intranet theme with a dashboard, knowledge management and role management, with project and CRM features added through its own extensions. Prices have changed since the first version of this article. The vendor sells version 6 as an annual subscription, from 99 US dollars a year for one site with one year of updates and support (according to the pricing page, as of 21 October 2026). Version 5 is still sold on ThemeForest, where the extensions are priced individually. Before buying, check whether you really need all those features, because each of them is code that has to be maintained.

The free route is BuddyPress: it adds profiles, private messages and groups to WordPress and runs on more than 90,000 sites. Together with All-In-One Intranet, Two Factor and Members, that gives you the basic setup without licence costs.

What does a WordPress intranet cost?

The software costs nothing: WordPress and the plugins mentioned are free in their basic versions. You pay for other things:

• Hosting in the EU, with backups and a data processing agreement.
• Optional licences, such as an intranet theme like Woffice (from 99 US dollars a year) or extra features of WPO365.
• The setup: login wall, roles, file protection, Microsoft sign-in and a structure your team understands.
• The content. The handbook, processes and contacts are usually written by your own team, and that takes longer than the technology.
• The upkeep: updates, backups and monitoring, every month.

I deliberately do not quote my own prices here. An intranet for 15 people with a login wall is a different project from one with Microsoft sign-in, file protection and custom roles. What a WordPress freelancer costs per hour and how to compare quotes is covered in How much does a WordPress website cost?.

To try it out: WordPress locally with XAMPP

If you first want to see what WordPress feels like as an intranet, install it on your own computer. With XAMPP you can do that without a server. A warning first, which comes from the XAMPP developers themselves: according to their FAQ, XAMPP is only meant for development environments and not for production. In the default configuration the database administrator “root” has no password and the database can be reached over the network. So never make this test installation accessible to other computers on the network.

1. Download XAMPP for your operating system from the Apache Friends website and install it.

2. Open the XAMPP Control Panel and start Apache and MySQL.

3. Open http://localhost/phpmyadmin/ in your browser and create a new, empty database, for example “wordpress”.

4. Download WordPress from WordPress.org, unzip it and copy the “wordpress” folder into the “htdocs” folder of your XAMPP installation. You open that folder in the Control Panel via “Open Application Folder”.

5. Open http://localhost/wordpress/ in your browser. The installation wizard starts.

6. Enter the database details: database name “wordpress”, username “root”, password empty, database host “localhost”, table prefix “wp_”. This is how XAMPP ships the database, and it is acceptable only for this test on your own computer.

7. Set the site title, a username and a strong password, click “Install WordPress” and then log in at http://localhost/wordpress/wp-admin/.

After that you can try out All-In-One Intranet, a theme and your first content. When the intranet is to go into production, move it to a hosted server instead of opening the test installation to the network.

Frequently asked questions

Is WordPress secure enough for an intranet?

Yes, if the whole site sits behind a login, the login uses a second factor or Microsoft sign-in, confidential files are protected separately and updates are installed regularly. The biggest risk is an intranet that nobody updates any more, because nobody outside notices it.

Can you build an intranet with WordPress for free?

The software, yes: WordPress, All-In-One Intranet, Two Factor, Members and BuddyPress cost nothing. Hosting, setup and upkeep cost money or your own working time. A free XAMPP installation on your own computer is enough for trying it out, but it is not meant for production.

Is WordPress GDPR compliant?

WordPress is software. Whether your intranet complies with the GDPR depends on how you run it: hosting in the EU with a data processing agreement under Art. 28 GDPR, only the profile data you need, and no plugins that send data to services outside the EU without being checked. This is not legal advice.

Do I need a special intranet theme?

No. For news, a handbook and a list of contacts, a normal, well-maintained theme with the right plugins is enough. An intranet theme such as Woffice is worth it if you want profiles, groups and project features in one package, and then it costs an annual subscription.

In my work as a WordPress developer I have already built several intranets. If you are planning one, we first clarify what content goes in and who may see what. That tells us whether WordPress is the right route or whether SharePoint fits better. Write to me via the contact form.