Augustus Rivers
Active2026

WHO — Digital Platform Modernization

Modernization concept for who.int: a component design system, a consolidated tag estate, tightened CORS and CSP, and a real performance budget — on the proprietary Sitefinity platform, across six languages and six regional sites.

Speculative concept — prepared independently by Offlabel, LLC. Not affiliated with the World Health Organization.

The Brief

  • WHO.org is the world’s health agency’s digital hub — health topics, emergencies, the Global Health Observatory, publications, and regional websites across six languages.
  • The platform works, but it runs on a proprietary .NET CMS with an enormous third-party tag estate and an open CORS policy.
  • The concept modernizes the platform without disrupting WHO’s global publishing operation.

Audit Findings

  • Proprietary Sitefinity CMS (.NET) — a commercial platform few teams can maintain or extend.
  • Open CORS (access-control-allow-origin: *) — unnecessary exposure for a public site.
  • 100+ third-party domains in the CSP — the tag estate has grown beyond what is measurable or accountable.
  • Heavy homepage payload (~131 KB HTML before images and scripts).
  • Cloudflare + HTTP/2 + 12-hour edge cache provide a workable baseline.
  • 6-language publishing with 6 regional sub-sites — a genuinely complex multilingual model.

Approach

  • Consolidate the tag estate into one accountable analytics stack, keeping only what is measured and used.
  • Tighten CORS to explicit origins; harden the CSP to a short, auditable allow-list.
  • Rebuild the presentation layer as a component design system on the existing CMS or a headless content layer.
  • Cut payload: WebP/AVIF images, static-friendly rendering, a real performance budget.
  • Preserve the 6-language and 6-region model with tested multilingual tooling.

Deliverables

  • Component-based design system
  • Tag-consolidation audit + single analytics stack
  • CORS + CSP hardening
  • Redesigned templates: health topics, emergencies, observatory
  • WebP/AVIF + performance budget
  • Multilingual (6 languages, 6 regions) tooling pass
  • WCAG 2.2 AA accessibility
  • Editor training

Evidence

Audited 2026-08. Live requests to who.int: response headers, CSP, page markup, and framework asset paths inspected directly.

  • Runs on Progress Sitefinity (.NET) — verified by telerik.sitefinity.frontend.* asset paths in the page markup.
  • access-control-allow-origin: * on responses — an open CORS policy on a public health agency domain.
  • The Content-Security-Policy whitelists 100+ third-party origins: donations (FundraiseUp, Stripe, PayPal), GIS (ArcGIS), search (SearchBlox, Yext), accessibility (Monsido), analytics (GA, Clarity, Hotjar), marketing (HubSpot, Marketo, Eloqua), and video (JWP, Vimeo).
  • Cloudflare CDN + HTTP/2; edge cache s-maxage 43200 (12 hours); homepage HTML ≈ 131 KB.
  • 6 UN languages and 6 regional websites (AFRO, PAHO, EMRO, EURO, SEARO, WPRO).

Timeline

Discovery 2 wks · Design system 4 wks · Build 8 wks · Migration & QA 4 wks · Launch + handover 2 wks (~20 weeks).

Live redesign conceptCurrent site (reference)