Modernization concept for who.int: a component design system, a consolidated tag estate, tightened CORS and CSP, and a real performance budget — on the proprietary Sitefinity platform, across six languages and six regional sites.
Speculative concept — prepared independently by Offlabel, LLC. Not affiliated with the World Health Organization.
The Brief
WHO.org is the world’s health agency’s digital hub — health topics, emergencies, the Global Health Observatory, publications, and regional websites across six languages.
The platform works, but it runs on a proprietary .NET CMS with an enormous third-party tag estate and an open CORS policy.
The concept modernizes the platform without disrupting WHO’s global publishing operation.
Audit Findings
Proprietary Sitefinity CMS (.NET) — a commercial platform few teams can maintain or extend.
Open CORS (access-control-allow-origin: *) — unnecessary exposure for a public site.
100+ third-party domains in the CSP — the tag estate has grown beyond what is measurable or accountable.
Heavy homepage payload (~131 KB HTML before images and scripts).
Cloudflare + HTTP/2 + 12-hour edge cache provide a workable baseline.
6-language publishing with 6 regional sub-sites — a genuinely complex multilingual model.
Approach
Consolidate the tag estate into one accountable analytics stack, keeping only what is measured and used.
Tighten CORS to explicit origins; harden the CSP to a short, auditable allow-list.
Rebuild the presentation layer as a component design system on the existing CMS or a headless content layer.
Cut payload: WebP/AVIF images, static-friendly rendering, a real performance budget.
Preserve the 6-language and 6-region model with tested multilingual tooling.
Deliverables
Component-based design system
Tag-consolidation audit + single analytics stack
CORS + CSP hardening
Redesigned templates: health topics, emergencies, observatory