Title: Vakanssi: Careers Page, Hiring & Applicant Tracking Author: Vakanssi Published: October 15, 2026 Last modified: October 15, 2026 --- Search plugins ![](https://ps.w.org/vakanssi/assets/banner-772x250.png?rev=3749092) ![](https://ps.w.org/vakanssi/assets/icon.svg?rev=3749092) # Vakanssi: Careers Page, Hiring & Applicant Tracking By [Vakanssi](https://profiles.wordpress.org/vakanssi/) [Download](https://downloads.wordpress.org/plugin/vakanssi.1.0.0.zip) * [Details](https://wordpress.org/plugins/vakanssi/#description) * [Reviews](https://wordpress.org/plugins/vakanssi/#reviews) * [Installation](https://wordpress.org/plugins/vakanssi/#installation) * [Development](https://wordpress.org/plugins/vakanssi/#developers) [Support](https://wordpress.org/support/plugin/vakanssi/) ## Description Vakanssi is a complete applicant tracking system (ATS) for WordPress: branded job listings with Google-for-Jobs structured data, a native application form, an applications inbox with a configurable drag-and-drop pipeline board, templated emails, and tools for handling candidate data (export, erasure and scheduled retention), all on your own server, with no per-seat SaaS fees. **A complete hiring workflow:** * **Jobs & careers**: a `vakanssi_job` post type, a branded careers archive (at`/ jobs/` by default, or on your own careers page) and `[vakanssi_jobs]` shortcode, and valid Google-for-Jobs `JobPosting` structured data that is withheld automatically when a job is not eligible (expired, no location, no apply path, …). * **Application intake**: a native application form with a secure CV upload (type- verified by magic bytes, randomised filename, owner-only permissions), spam/ honeypot/rate-limiting, and candidate de-duplication by email. * **Applications inbox & pipeline board**: a sortable, filterable inbox plus a build-free React Kanban board with a candidate profile drawer; configurable stages; bulk move/delete. * **Interviews & calendar invites**: schedule an interview from the candidate’s record and send a real `.ics` invite that Google, Outlook and Apple render as an actionable event, with no OAuth and no connected account. Reschedule, cancel, and keep internal notes that reach your interviewers’ calendars and never the candidate’s. * **Application data & export**: export applications to CSV, print or save any application as a PDF, and edit application details, right from the inbox. * **Email**: templated confirmation/recruiter/rejection/offer emails with personalization tags and an SMTP-compatible sender, logged and de-duplicated. * **Candidate data controls**: consent capture, WordPress core data export/erase integration (with a complete cascade across all candidate data), a retention- purge cron, and an audit log. These are tools you operate; they do not by themselves make a site compliant with any particular law. * **Blocks, page builders & themes**: a Job Listings block for the block editor, native **Elementor** widgets for the listing, the application form and the job details (Elementor Pro Theme Builder archive/single templates are respected too), a **Divi** module, and shortcodes for everywhere else. Block themes on WordPress 6.7 and later get editable Site Editor templates; classic themes get the built- in archive. * **First-run setup wizard**: sender identity and a careers page in a few clicks, with optional sample content and a prompt to post your first job. * **Foundations**: scale-ready custom tables (engineered for 10k+ applications), a modular architecture (disabled modules load no code/assets), capability-based roles (Recruiter, Hiring Manager, HR/Compliance), and a `vakanssi/v1` REST API with per-route permission checks. ### External services Vakanssi does not contact any external service on its own. Everything it stores stays on your server. One optional integration talks to a third party, and only after you switch it on and enter your own credentials: **Cloudflare Turnstile** (optional spam protection for the public application form) Turnstile is off by default. It activates only once you enter a Turnstile site key and secret under Hiring Settings Application form. While it is enabled: * each visitor’s browser loads the challenge script from https://challenges.cloudflare. com/turnstile/v0/api.js; * when someone submits an application, the resulting challenge token, the visitor’s IP address and your secret key are sent to https://challenges.cloudflare.com/ turnstile/v0/siteverify so Cloudflare can confirm the submission is not automated; * when an administrator uses “Test these keys” on the settings screen, that admin’s browser loads the same challenge script, and the resulting token, the admin’s IP address and the secret key being tested are sent to the same address, so the key pair can be checked without waiting for a real application. No application content (no name, email, CV, or answers) is sent to Cloudflare. Turning the setting off stops all contact with the service. Service: https://www.cloudflare.com/products/turnstile/ Terms of service: https:// www.cloudflare.com/terms/ Privacy policy: https://www.cloudflare.com/privacypolicy/ ## Screenshots [⌊The hiring pipeline. Drag candidates between your own stages, with a live count on each and ratings, attachments and dates at a glance.⌉⌊The hiring pipeline. Drag candidates between your own stages, with a live count on each and ratings, attachments and dates at a glance.⌉[ The hiring pipeline. Drag candidates between your own stages, with a live count on each and ratings, attachments and dates at a glance. [⌊A candidate. CV on file with an inline preview, rating, notes, interviews and the full history, without leaving the board.⌉⌊A candidate. CV on file with an inline preview, rating, notes, interviews and the full history, without leaving the board .⌉[ A candidate. CV on file with an inline preview, rating, notes, interviews and the full history, without leaving the board. [⌊Your careers page. Branded, filterable, and marked up for Google for Jobs.⌉⌊Your careers page. Branded, filterable, and marked up for Google for Jobs.⌉[ Your careers page. Branded, filterable, and marked up for Google for Jobs. [⌊The application form. Secure CV upload, LinkedIn and cover letter, on your own job page.⌉⌊The application form. Secure CV upload, LinkedIn and cover letter, on your own job page.⌉[ The application form. Secure CV upload, LinkedIn and cover letter, on your own job page. [⌊Interviews. Schedule an interview and send a real calendar invite, with internal notes only your interviewers see.⌉⌊Interviews. Schedule an interview and send a real calendar invite, with internal notes only your interviewers see.⌉[ Interviews. Schedule an interview and send a real calendar invite, with internal notes only your interviewers see. [⌊Setup. Three short steps. It looks at your site first and offers to connect an existing careers page instead of creating a duplicate.⌉⌊Setup. Three short steps. It looks at your site first and offers to connect an existing careers page instead of creating a duplicate.⌉[ Setup. Three short steps. It looks at your site first and offers to connect an existing careers page instead of creating a duplicate. ## Blocks This plugin provides 1 block. * Job Listings A filterable list of your open positions, the same output as the[ vakanssi_jobs] shortcode. ## Installation 1. Upload the `vakanssi` folder to `/wp-content/plugins/`, or install through the Plugins screen. 2. Activate the plugin. Activation creates the database tables, installs roles, provisions protected file storage, and opens a short setup wizard. 3. Complete **Hiring Setup** (sender email, careers page), post your first job, then review **Hiring Tools Status** for system status. ## FAQ ### Does removing the plugin delete my candidate data? No. Uninstalling removes roles, capabilities, and plugin settings, but your hiring data is kept unless you explicitly enable **Hiring Settings General Delete all data on uninstall**. ### Are uploaded CVs protected from direct download? Yes, with defence in depth. Candidate files are stored in a protected `vakanssi` folder in your uploads directory, under random 128-bit file names, with an Apache deny rule, index guards and a generated Nginx rule. Vakanssi then **verifies over HTTP** that the folder is not directly reachable, and shows an admin warning (with the exact Nginx rule to add) if it is. The plugin itself only serves CVs through an authenticated, permission-checked download link. ### Who on my team can see candidate applications and CVs? Anyone you grant a hiring role to. Vakanssi ships three roles (Recruiter, Hiring Manager, and HR / Compliance) plus Administrator, and any user with the “view applications” capability can see **every** candidate and download **every** CV in the pipeline. In other words, Vakanssi does not restrict staff to only the jobs or candidates assigned to them: it assumes your hiring team is trusted, which is the right default for most small teams. Only grant these roles to people who should see all applicants. ### How do I report a security issue? Email **security@vakanssi.com** rather than posting in the support forum, so a fix can ship before the details are public. Please include the Vakanssi version, your WordPress and PHP versions, and steps to reproduce. You will get an acknowledgement within three business days and an initial assessment within a week, and you will be credited in the changelog for the release that fixes it unless you would rather not be. Only the most recent release receives security fixes, so updating is always part of the answer. ### What personal data is included in a GDPR data-export request? When you run **Tools Export Personal Data** for a candidate’s email, Vakanssi includes their profile (name, email, phone, location), every application (position, stage, status, date, and whether consent was given), the cover letter, their LinkedIn profile, each uploaded CV/attachment (the file itself, with its filename and upload date), the submission context stored with the application (the page the application was sent from), the recruiter notes and interview notes written about them, their interviews, and the emails Vakanssi sent them. The export deliberately does **not** name the staff member who wrote a note, gave a rating, or conducted an interview. That is a third party’s personal data, not the candidate’s. The matching **Erase Personal Data** tool removes all of it, including the CV files on disk. Export and erasure share one list of the tables that hold notes, interviews and emails about a candidate, so the two stay in step. ### Does it work on WordPress multisite? Yes, activated per site or network-wide. Each site keeps its own jobs, candidates, CVs and settings (data is never shared between sites), and each site chooses independently whether deleting the plugin also deletes its hiring data. When Vakanssi is network- activated, deleting a site removes that site’s Vakanssi data with it. There is no network-level configuration screen; settings are per site. ### Does it work on Nginx? Yes. Nginx ignores `.htaccess`, so add the generated `location` block to your server config. The plugin’s screens show the rule, and Site Health flags the folder, when it is reachable. ### Does it work with my theme and page builder? Yes, and you do not have to fall back to a shortcode. The block editor gets a ** Job Listings** block. **Elementor** gets three native widgets (the listing, the application form, and the job details) grouped under a Vakanssi section in the panel, and they work with the free Elementor; if you run Elementor Pro, your Theme Builder archive and single templates for jobs are used instead of ours. **Divi** gets a Jobs module. Shortcodes (`[vakanssi_jobs]`, `[vakanssi_job_apply]`, [vakanssi_job_details]) still work anywhere else, including builders with no dedicated integration. Themes need nothing special. Block themes on WordPress 6.7 and later get editable“ Jobs archive” (while the archive page is on) and “Single job” templates in the Site Editor, built from your own header and footer; classic themes get the built- in archive. The candidate-facing pages are styled so they survive a theme’s own CSS reset, so the listing and the apply button look the same whichever theme you run. ### Can I restyle the careers/job pages, and will custom CSS slow my site down? Yes. Under **Hiring Settings Jobs & Careers Appearance** you can turn off Vakanssi’s front-end stylesheet entirely, if your theme styles the markup. For your own styling, use WordPress’s built-in editor at **Appearance Customize Additional CSS**, which adds no extra request. Vakanssi keeps its own selectors deliberately low-weight and its class names stable. Match their weight, such as .vakanssi-apply-form .vakanssi- apply-button for the application form’s Submit button or .vakanssi-apply .vakanssi- apply-button for a job’s Apply link, and style `:hover`, `:focus` and :active as well, since Vakanssi sets those too. On most pages that is enough without `!important`. The same `vakanssi-` class names are on the careers and job pages under block themes and classic themes alike, so one rule covers both. On a block theme your theme keeps control of the page width and spacing and Vakanssi adds no styling of its own to those wrappers, so your rules apply exactly as you write them. ### Do I need any special server setup for a production site? Two things are worth doing on a live hiring site, and both are standard WordPress production hygiene rather than Vakanssi requirements. First, switch WordPress to a real cron trigger: out of the box, WordPress runs scheduled tasks only when someone visits your site, so on a quiet careers site scheduled work can run late. Vakanssi relies on it to purge candidate data once its retention period is up. Add `define(' DISABLE_WP_CRON', true );` to `wp-config.php` and trigger wp-cron.php every few minutes; most managed hosts offer this as a checkbox. Second, if your host offers a persistent object cache (Redis or Memcached), enable it: Vakanssi uses transients for its dashboard counters, and an object cache keeps those out of the database under heavy traffic. Apply-form rate limits always use the database, so they hold either way. Nothing breaks without either step. ### Can I disable the /jobs/ archive page? Yes: **Hiring Settings Jobs & Careers Job URLs** “Archive page”. Single job pages stay live under your job URL base (e.g. /jobs/job-title/); the archive URL becomes available for your own page, such as a Careers page using the [vakanssi_jobs] shortcode. ### What stops two recruiters overwriting each other on the board? Every save carries the state the screen was showing when you started editing. If someone else changed that candidate first, the save is refused and you are shown what changed instead of quietly losing one of the two edits. This runs over ordinary REST requests, so it needs nothing special on your server and works on any host that runs WordPress normally. ### Is there a Pro version? Yes. Vakanssi Pro is a separate plugin, coming soon, for teams that need more. Everything in this plugin stays free and fully working. Get notified when it launches at https:// vakanssi.com/#notify ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Vakanssi: Careers Page, Hiring & Applicant Tracking” is open source software. The following people have contributed to this plugin. Contributors * [ Vakanssi ](https://profiles.wordpress.org/vakanssi/) [Translate “Vakanssi: Careers Page, Hiring & Applicant Tracking” into your language.](https://translate.wordpress.org/projects/wp-plugins/vakanssi) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/vakanssi/), check out the [SVN repository](https://plugins.svn.wordpress.org/vakanssi/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/vakanssi/) by [RSS](https://plugins.trac.wordpress.org/log/vakanssi/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First stable release. Updating from 0.37.15 keeps your jobs, applications, settings and Additional CSS as they are. * Fixed: the advice under Settings, Jobs & Careers, Appearance said a single class such as `.vakanssi-apply-button` was enough to restyle the Apply buttons from Additional CSS. It was not, because Vakanssi styles them two classes deep. The advice now names selectors that work, `.vakanssi-apply-form .vakanssi-apply-button` and `.vakanssi-apply .vakanssi-apply-button`, and reminds you to style `:hover`,`: focus` and `:active` too. * Fixed: the applications CSV export shows candidate names, stage names and sources that contain “<” as typed. * Changed: the plugin is now listed as “Vakanssi: Careers Page, Hiring & Applicant Tracking”, so it is easier to find when you search for a careers page. * Security: CSV exports also neutralise a spreadsheet formula hidden behind leading spaces, line breaks or invisible characters. * Changed: for developers, the `vakanssi/export/row` filter receives the name, stage and source cells as plain text. #### 0.37.15 * Fixed: a job title with an apostrophe, a quote or an ampersand, such as “Director’s Assistant”, shows as typed in interview calendar invites, the applications CSV export, the Applications board, the application drawer, the job filter and the job details search engines read. Before, those showed HTML code in place of that character. * Fixed: interview titles, locations and notes that contain “<“, and team members’ names that contain “&”, show as typed in the interview panel and in calendar invites. Saving an interview without changing its text keeps that text exactly as it was. * Changed: the team’s “New application” email names where the application came from (“Careers page”) instead of the stored value (“native”), in the site’s language, also when someone using WordPress in another language resends it. * Changed: for developers, job titles and interview text in the REST API, and the job title and company name in the job’s structured data, are plain text instead of HTML entities. Escape them before printing them as HTML. #### 0.37.14 * Fixed: email subjects are sent as plain text. A job title with an apostrophe, a quote or an ampersand, such as “Director’s Assistant”, reached candidates with HTML code in place of that character. * Fixed: the application drawer and the printed application sheet show the source’s name (“Careers page”, “Added manually”, “Imported from WP Job Manager”) instead of the stored value, such as “native”. A source someone typed in is shown as typed. The applications list in the REST API carries the name as `source_label` beside `source`. * Fixed: the Getting started steps on Hiring HQ stay open while the only jobs and applications on the site are sample data. Before, adding the sample data folded the steps away although none of them was done. ## Meta * Version **1.0.0** * Last updated **15 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [applicant tracking](https://wordpress.org/plugins/tags/applicant-tracking/)[ats](https://wordpress.org/plugins/tags/ats/) [careers](https://wordpress.org/plugins/tags/careers/)[hiring](https://wordpress.org/plugins/tags/hiring/) [recruiting](https://wordpress.org/plugins/tags/recruiting/) * [Advanced View](https://wordpress.org/plugins/vakanssi/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/vakanssi/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/vakanssi/reviews/) ## Contributors * [ Vakanssi ](https://profiles.wordpress.org/vakanssi/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/vakanssi/)