Website Security for UK Recruitment Agencies: Protecting Candidate Data

The Data Risk Sitting Inside Every Recruiter's Website

Recruitment agency websites are not just marketing pages. Behind the polished candidate portals, job application forms, and CV upload tools sits a repository of personally identifiable information that GDPR classifies as requiring active protection: names, addresses, phone numbers, employment histories, salary expectations, references, and in some sectors, DBS check results or medical declarations.

A breach of that data carries the same GDPR exposure as any other organisation handling personal data — up to £17.5 million or 4% of global annual turnover under UK GDPR, plus mandatory ICO notification and the reputational cost of telling thousands of job seekers that their personal information was compromised.

Yet the web platforms most recruiters use — WordPress job boards, custom ATS integrations, third-party candidate portals — are often configured and then left, without security testing or regular maintenance.

---

What Attackers Want From Recruitment Agencies

Candidate data is commercially valuable on criminal marketplaces. Full employment profiles — name, current employer, salary, contact details, career history — are worth significantly more than a standalone email address because they enable targeted social engineering and business email compromise.

Attackers who compromise a recruiter's systems can:

- Harvest thousands of candidate profiles for resale - Impersonate the agency to send phishing emails to candidates ("We have an urgent role — please verify your bank details for payroll setup") - Access client data including hiring manager contacts, salary bands, and headcount plans - Use CV upload functionality to upload malicious files that exploit staff machines when opened

---

Common Vulnerabilities in Recruitment Websites

**Unrestricted file upload** — CV upload forms are the most common attack vector. Without proper validation, an attacker can upload executable files disguised as CVs. When a staff member opens the file, malware executes on their machine.

**SQL injection in job search and application forms** — Custom job boards built without prepared statements are vulnerable to SQL injection, which can expose the entire candidate database.

**Broken access control in candidate portals** — Applications that use predictable IDs in URLs (e.g., `/candidate/12345/profile`) without server-side authorisation checks allow attackers to access other candidates' profiles by incrementing the number — a vulnerability called Insecure Direct Object Reference (IDOR).

**Session hijacking** — Weak session management in login portals allows attackers to steal authenticated sessions and access accounts without credentials.

**Exposed API endpoints** — Modern ATS integrations expose REST APIs. Without proper authentication and rate limiting, these endpoints can be enumerated to extract candidate records at scale.

**Outdated WordPress and plugins** — Job board plugins like WP Job Manager, JobListings, and similar tools have historically had significant vulnerabilities. Unpatched installations are routinely targeted by automated scanners.

---

GDPR Obligations for Recruitment Agencies

Under UK GDPR, recruitment agencies are data controllers for the candidate information they hold. Key obligations include:

**Article 32 — Security of processing**: You must implement appropriate technical and organisational measures to ensure security appropriate to the risk. For a system holding thousands of employment profiles, that includes security testing.

**Article 33 — Breach notification**: A breach of candidate data must be reported to the ICO within 72 hours if it is likely to result in a risk to individuals' rights and freedoms.

**Data retention**: Candidate data should not be held longer than necessary. Systems should have mechanisms to delete profiles after a defined period of inactivity — a technical control that should be tested.

**Privacy by design**: New application features — a new CV upload function, a new candidate portal — should be assessed for security implications before deployment.

---

What a Security Assessment Covers

A web application security assessment for a recruitment agency website typically examines:

- The candidate application and CV upload flow - Candidate portal authentication and session management - ATS API endpoints and their access controls - The job board administration panel - Any third-party integrations (background check platforms, payroll integrations) - The public-facing website for injection vulnerabilities and misconfigured headers

---

Yrzo AI for Recruitment Agencies

Yrzo AI automates web application security testing so recruitment agencies can get a clear picture of their exposure without a lengthy, expensive engagement. A scan covers the most critical vulnerabilities in candidate-facing systems and produces a prioritised report your development team or IT provider can act on immediately.

Scans start from £99 and complete within minutes. Reports are written for both technical and non-technical audiences — useful for demonstrating GDPR Article 32 compliance to clients or during an ICO investigation.