WordPress Security for Law Firms and Legal Services

Law firms and legal service websites handle some of the most sensitive information—privileged communications, case details, and confidential client data. Security breaches can result in ethical violations, malpractice claims, and loss of client trust.

Legal Industry Security Requirements

• Attorney-client privilege - Protect confidential communications
• Case file security - Sensitive legal documents
• Ethical obligations - Bar association requirements
• Client portals - Secure document sharing
• Intake forms - Initial consultation data

Client Portal Security

Secure Document Access

// Secure client document portal
function secure_client_portal() {
    if (!is_page('client-portal')) {
        return;
    }

    // Require authentication
    if (!is_user_logged_in()) {
        wp_redirect(wp_login_url(get_permalink()));
        exit;
    }

    // Verify client role
    if (!current_user_can('access_client_portal')) {
        wp_die('Access denied.');
    }

    // Force HTTPS
    if (!is_ssl()) {
        wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
        exit;
    }
}
add_action('template_redirect', 'secure_client_portal');

// Client can only access their own documents
function restrict_client_documents($query) {
    if (is_admin() || !is_user_logged_in()) {
        return $query;
    }

    if ($query->get('post_type') === 'client_document') {
        $user_id = get_current_user_id();

        // Clients see only their documents
        if (current_user_can('client')) {
            $query->set('meta_key', '_client_id');
            $query->set('meta_value', $user_id);
        }
    }

    return $query;
}
add_action('pre_get_posts', 'restrict_client_documents');

Secure File Downloads

// Protect document downloads
function secure_legal_document_download($file_id) {
    // Verify user has access
    $document = get_post($file_id);
    $client_id = get_post_meta($file_id, '_client_id', true);

    if (get_current_user_id() != $client_id &&
        !current_user_can('manage_all_clients')) {
        wp_die('You do not have permission to access this document.');
    }

    // Log the download
    log_document_access(array(
        'document_id' => $file_id,
        'user_id' => get_current_user_id(),
        'action' => 'download',
        'timestamp' => current_time('mysql'),
        'ip_address' => wpfs_get_client_ip()
    ));

    // Serve file securely
    $file_path = get_attached_file(get_post_meta($file_id, '_file_attachment', true));

    header('Content-Type: application/pdf');
    header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
    header('Cache-Control: no-cache, no-store, must-revalidate');

    readfile($file_path);
    exit;
}

Communication Security

// Secure client messaging
function secure_client_message($message_data) {
    // Encrypt message content
    $encrypted_content = openssl_encrypt(
        $message_data['content'],
        'AES-256-CBC',
        SECURE_AUTH_KEY,
        0,
        substr(SECURE_AUTH_SALT, 0, 16)
    );

    $message = array(
        'from_user' => get_current_user_id(),
        'to_user' => absint($message_data['to']),
        'matter_id' => absint($message_data['matter_id']),
        'content_encrypted' => $encrypted_content,
        'sent_at' => current_time('mysql')
    );

    // Verify recipient is associated with matter
    if (!user_can_access_matter($message['to_user'], $message['matter_id'])) {
        return new WP_Error('invalid_recipient', 'Invalid recipient.');
    }

    global $wpdb;
    $wpdb->insert($wpdb->prefix . 'client_messages', $message);

    return $wpdb->insert_id;
}

// Decrypt message for reading
function decrypt_client_message($message_id) {
    global $wpdb;

    $message = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM {$wpdb->prefix}client_messages WHERE id = %d",
        $message_id
    ));

    // Verify user can read message
    $user_id = get_current_user_id();
    if ($message->from_user != $user_id &&
        $message->to_user != $user_id &&
        !current_user_can('manage_all_clients')) {
        return new WP_Error('access_denied', 'Cannot read this message.');
    }

    // Decrypt content
    $decrypted = openssl_decrypt(
        $message->content_encrypted,
        'AES-256-CBC',
        SECURE_AUTH_KEY,
        0,
        substr(SECURE_AUTH_SALT, 0, 16)
    );

    $message->content = $decrypted;
    unset($message->content_encrypted);

    return $message;
}

Intake Form Security

// Secure consultation intake
function secure_intake_form($data) {
    // Validate and sanitize
    $clean = array(
        'name' => sanitize_text_field($data['name']),
        'email' => sanitize_email($data['email']),
        'phone' => sanitize_text_field($data['phone']),
        'matter_type' => sanitize_key($data['matter_type']),
        'description' => sanitize_textarea_field($data['description'])
    );

    // Encrypt sensitive details before storage
    $clean['description_encrypted'] = encrypt_intake_data($clean['description']);
    unset($clean['description']);

    // Don't store in plain text post meta
    // Use dedicated secure table

    return $clean;
}

// NEVER email sensitive case details
function safe_intake_notification($intake_id) {
    // Only notify of new intake, don't include details
    wp_mail(
        get_option('admin_email'),
        'New Consultation Request',
        'A new consultation request has been submitted. ' .
        'Please log in to view details: ' . admin_url('admin.php?page=intakes')
    );
}

Staff Access Control

// Legal role hierarchy
function setup_legal_roles() {
    add_role('attorney', 'Attorney', array(
        'read' => true,
        'access_client_portal' => true,
        'view_assigned_matters' => true,
        'manage_assigned_clients' => true
    ));

    add_role('paralegal', 'Paralegal', array(
        'read' => true,
        'access_client_portal' => true,
        'view_assigned_matters' => true
    ));

    add_role('legal_secretary', 'Legal Secretary', array(
        'read' => true,
        'manage_calendar' => true,
        'view_client_contacts' => true
    ));
}

Compliance Checklist

• [ ] Client data encrypted at rest
• [ ] Secure client portal with 2FA
• [ ] Document access logging
• [ ] Role-based access control
• [ ] Secure backup procedures
• [ ] Data retention policies
• [ ] Staff security training

Conclusion

Law firm websites must protect privileged communications and maintain client confidentiality. Implement encryption, access controls, and comprehensive audit logging to meet ethical obligations and protect your practice.