Deskripzioa
Vakanssi is a complete applicant tracking system (ATS) for WordPress: branded job listings with Google-for-Jobs
structured data, a native application form, an applications inbox with a configurable drag-and-drop
pipeline board, templated emails, and tools for handling candidate data (export, erasure and
scheduled retention), all on your own server, with no per-seat SaaS fees.
A complete hiring workflow:
- Jobs & careers: a
vakanssi_jobpost type, a branded careers archive (at/jobs/by default, or on
your own careers page) and[vakanssi_jobs]shortcode, and valid Google-for-JobsJobPostingstructured data that is
withheld automatically when a job is not eligible (expired, no location, no apply path, …). - Application intake: a native application form with a secure CV upload (type-verified by magic
bytes, randomised filename, owner-only permissions), spam/honeypot/rate-limiting, and candidate
de-duplication by email. - Applications inbox & pipeline board: a sortable, filterable inbox plus a build-free React
Kanban board with a candidate profile drawer; configurable stages; bulk move/delete. - Interviews & calendar invites: schedule an interview from the candidate’s record and send a
real.icsinvite that Google, Outlook and Apple render as an actionable event, with no OAuth and
no connected account. Reschedule, cancel, and keep internal notes that reach your interviewers’
calendars and never the candidate’s. - Application data & export: export applications to CSV, print or save any application as a PDF, and edit application details, right from the inbox.
- Email: templated confirmation/recruiter/rejection/offer emails with personalization tags and
an SMTP-compatible sender, logged and de-duplicated. - Candidate data controls: consent capture, WordPress core data export/erase integration (with a
complete cascade across all candidate data), a retention-purge cron, and an audit log. These are
tools you operate; they do not by themselves make a site compliant with any particular law. - Blocks, page builders & themes: a Job Listings block for the block editor, native Elementor
widgets for the listing, the application form and the job details (Elementor Pro Theme Builder
archive/single templates are respected too), a Divi module, and shortcodes for everywhere else.
Block themes on WordPress 6.7 and later get editable Site Editor templates; classic themes get the
built-in archive. - First-run setup wizard: sender identity and a careers page in a few clicks, with optional
sample content and a prompt to post your first job. - Foundations: scale-ready custom tables (engineered for 10k+ applications), a modular
architecture (disabled modules load no code/assets), capability-based roles (Recruiter, Hiring
Manager, HR/Compliance), and avakanssi/v1REST API with per-route
permission checks.
External services
Vakanssi does not contact any external service on its own. Everything it stores stays on
your server. One optional integration talks to a third party, and only after you switch it
on and enter your own credentials:
Cloudflare Turnstile (optional spam protection for the public application form)
Turnstile is off by default. It activates only once you enter a Turnstile site key and
secret under Hiring Settings Application form. While it is enabled:
- each visitor’s browser loads the challenge script from
https://challenges.cloudflare.com/turnstile/v0/api.js; - when someone submits an application, the resulting challenge token, the visitor’s IP
address and your secret key are sent to
https://challenges.cloudflare.com/turnstile/v0/siteverify so Cloudflare can confirm the
submission is not automated; - when an administrator uses “Test these keys” on the settings screen, that admin’s browser
loads the same challenge script, and the resulting token, the admin’s IP address and the
secret key being tested are sent to the same address, so the key pair can be checked
without waiting for a real application.
No application content (no name, email, CV, or answers) is sent to Cloudflare. Turning the
setting off stops all contact with the service.
Service: https://www.cloudflare.com/products/turnstile/
Terms of service: https://www.cloudflare.com/terms/
Privacy policy: https://www.cloudflare.com/privacypolicy/
Pantaila-argazkiak
Blokeak
Plugin honek 1 blokea hornitzen du.
- Job Listings A filterable list of your open positions, the same output as the [vakanssi_jobs] shortcode.
Instalazioa
- Upload the
vakanssifolder to/wp-content/plugins/, or install through the Plugins screen. - Activate the plugin. Activation creates the database tables, installs roles, provisions protected file storage, and opens a short setup wizard.
- Complete Hiring Setup (sender email, careers page), post your first job, then review Hiring Tools Status for system status.
MEG
-
Does removing the plugin delete my candidate data?
-
No. Uninstalling removes roles, capabilities, and plugin settings, but your hiring data is kept
unless you explicitly enable Hiring Settings General Delete all data on uninstall.
While another copy of Vakanssi is still installed (for example in a second plugin folder),
deleting a copy removes nothing, so the copy you keep runs with its settings and data. -
Are uploaded CVs protected from direct download?
-
Yes, with defence in depth. Candidate files are stored in a protected
vakanssifolder in
your uploads directory, under random 128-bit file names, with an Apache deny rule, index guards and a
generated Nginx rule. Vakanssi then verifies over HTTP that the folder is not directly reachable,
and shows an admin warning (with the exact Nginx rule to add) if it is. The plugin itself only serves
CVs through an authenticated, permission-checked download link.
To keep them outside your public site entirely, defineVAKANSSI_STORAGE_DIRas an absolute path inwp-config.php; moving your existing CVs is covered at https://docs.vakanssi.com/admin/move-cv-storage/ -
Who on my team can see candidate applications and CVs?
-
Anyone you grant a hiring role to. Vakanssi ships three roles (Recruiter, Hiring Manager, and HR / Compliance)
plus Administrator, and any user with the “view applications” capability can see every candidate
and download every CV in the pipeline. In other words, Vakanssi does not restrict staff to only
the jobs or candidates assigned to them: it assumes your hiring team is trusted, which is the right
default for most small teams. Only grant these roles to people who should see all applicants. -
How do I report a security issue?
-
Email security@vakanssi.com rather than posting in the support forum, so a fix can ship before
the details are public. Please include the Vakanssi version, your WordPress and PHP versions, and
steps to reproduce. You will get an acknowledgement within three business days and an initial
assessment within a week, and you will be credited in the changelog for the release that fixes it
unless you would rather not be. Only the most recent release receives security fixes, so updating
is always part of the answer. -
What personal data is included in a GDPR data-export request?
-
When you run Tools Export Personal Data for a candidate’s email, Vakanssi includes their
profile (name, email, phone, location), every application (position, stage, status, date, and whether
consent was given), the cover letter, their LinkedIn profile, each uploaded CV/attachment (the file itself, with its
filename and upload date), the submission context stored with the application (the page the application was sent from), the
recruiter notes and interview notes written about them, their interviews, and the emails Vakanssi
sent them. Other details stored with an application or the candidate are included too, under
“Additional application data”. The export deliberately does not name the staff member who wrote a note, gave a
rating, or conducted an interview. That is a third party’s personal data, not the candidate’s.The matching Erase Personal Data tool removes all of it, including the CV files on disk. Export
and erasure share one list of the tables that hold notes, interviews and emails about a candidate,
so the two stay in step. -
Does it work on WordPress multisite?
-
Yes, activated per site or network-wide. Each site keeps its own jobs, candidates, CVs and
settings (data is never shared between sites), and each site chooses independently whether
deleting the plugin also deletes its hiring data. There is no network-level configuration screen; settings are per site.Network activation is the recommended setup: deleting a site then removes that site’s Vakanssi
data with it. With per-site activation, a site deleted where Vakanssi is not active keeps its
Vakanssi tables, and its CVs when they are in a custom storage folder, until you remove them by
hand. A single site turned into a network keeps finding the CVs it stored before, and Site Health
names the folder to move them from. -
Does it work on Nginx?
-
Yes. Nginx ignores
.htaccess, so add the generatedlocationblock to your server config. The
plugin’s screens show the rule, and Site Health flags the folder, when it is reachable. -
Does it work with my theme and page builder?
-
Yes, and you do not have to fall back to a shortcode. The block editor gets a Job Listings
block. Elementor gets three native widgets (the listing, the application form, and the job
details) grouped under a Vakanssi section in the panel, and they work with the free Elementor; if
you run Elementor Pro, your Theme Builder archive and single templates for jobs are used instead of
ours. Divi gets a Jobs module. Shortcodes ([vakanssi_jobs],[vakanssi_job_apply],
[vakanssi_job_details]) still work anywhere else, including builders with no dedicated
integration.Themes need nothing special. Block themes on WordPress 6.7 and later get editable “Jobs archive” (while the archive page is on)
and “Single job” templates in the Site Editor, built from your own header and footer; classic themes get the built-in archive. The
candidate-facing pages are styled so they survive a theme’s own CSS reset, so the listing and the
apply button look the same whichever theme you run. -
Can I restyle the careers/job pages, and will custom CSS slow my site down?
-
Yes. Under Hiring Settings Jobs & Careers Appearance you can turn off Vakanssi’s front-end stylesheet
entirely, if your theme styles the markup. For your own styling, use WordPress’s built-in editor at
Appearance Customize Additional CSS, which adds no extra request. Vakanssi keeps its own
selectors deliberately low-weight and its class names stable. Match their weight, such as
.vakanssi-apply-form .vakanssi-apply-button for the application form’s Submit button or
.vakanssi-apply .vakanssi-apply-button for a job’s Apply link, and style:hover,:focusand
:active as well, since Vakanssi sets those too. On most pages that is enough without!important.The same
vakanssi-class names are on the careers and job pages under block themes and classic
themes alike, so one rule covers both. On a block theme your theme keeps control of the page width
and spacing and Vakanssi adds no styling of its own to those wrappers, so your rules apply exactly
as you write them. -
Do I need any special server setup for a production site?
-
Two things are worth doing on a live hiring site, and both are standard WordPress production
hygiene rather than Vakanssi requirements. First, switch WordPress to a real cron trigger:
out of the box, WordPress runs scheduled tasks only when someone visits your site, so on a
quiet careers site scheduled work can run late. Vakanssi relies on it to purge candidate data once
its retention period is up. Adddefine( 'DISABLE_WP_CRON', true );towp-config.phpand trigger
wp-cron.php every few minutes; most managed hosts offer this as a checkbox. Second, if your
host offers a persistent object cache (Redis or Memcached), enable it: Vakanssi uses
transients for its dashboard counters, and an object cache keeps those out of the database
under heavy traffic. Apply-form rate limits always use the database, so they hold either way. Nothing breaks without either step. -
Can I disable the /jobs/ archive page?
-
Yes: Hiring Settings Jobs & Careers Job URLs “Archive page”. Single job pages stay
live under your job URL base (e.g. /jobs/job-title/); the archive URL becomes available for your own
page, such as a Careers page using the [vakanssi_jobs] shortcode. -
What stops two recruiters overwriting each other on the board?
-
Every save carries the state the screen was showing when you started editing. If someone else
changed that candidate first, the save is refused and you are shown what changed instead of
quietly losing one of the two edits. This runs over ordinary REST requests, so it needs nothing
special on your server and works on any host that runs WordPress normally. -
Is there a Pro version?
-
Yes. Vakanssi Pro is a separate plugin, coming soon, for teams that need more. Everything in this plugin stays free and fully working. Get notified when it launches at https://vakanssi.com/#notify
Berrikuspenak
Ez dago berrikuspenik plugin honentzat.
Laguntzaileak eta Garatzaileak
“Vakanssi: Careers Page, Hiring & Applicant Tracking” software librea da. Ondoko pertsonek egin dizkiote ekarpenak plugin honi.
Laguntzaileak
Itzul zaitez Vakanssi: Careers Page, Hiring & Applicant Tracking zure hizkuntzara.
Garapena interesatzen zaizu?
Araka kodea, begiratu SVN biltegia edo harpidetu garapen erregistrora RSS bidez.
Aldaketen loga
1.2.5
- Fixed: editing a location, even just its description, no longer changes the city of jobs in the locations under it, and editing “Remote” no longer gives remote jobs the city “Remote”.
- Fixed: saving a job without changes keeps all of its locations, for example after an import, instead of keeping only the first one alphabetically.
- Fixed: you can clear a job’s location, and a deleted location no longer comes back the next time a job is saved. Deleting a location also removes it as the city of the jobs that used it.
- Changed: Quick Edit and Bulk Edit on All Jobs no longer offer locations, because they changed a job’s location without its city. Set the location in the job editor.
- Fixed: a location or department name with no letters or numbers is skipped (the import log says so) instead of filing the job under an unrelated place or team.
- Fixed: an “&” in a location now shows as “&” in Google for Jobs data, the REST API, job filters and the Jobs block, and location names over 200 characters save.
- Fixed: changing a job’s city over the REST API also updates its location, and CSV import keeps backslashes in names, so importing the same file again finds the existing jobs.
- Fixed: picking a team on the careers page also shows its sub-teams’ roles and roles that list it as a second team, matching the shortcode’s department setting.
- Fixed: visitors can no longer list departments used only by draft, private, password-protected, expired or sample jobs through the REST API, or read department descriptions there.
- Changed: the Departments and Locations screens explain each field in plain words, and saving jobs says “Job published” and “2 jobs updated” instead of “Post”.
1.2.4
- New: Departments and Locations are in the Hiring menu.
- Fixed: the importer checks each CV’s contents. A PDF or Word file saved under the wrong one of those extensions is kept under its real type; anything else is skipped, and the import log says why.
- Fixed: Simple Job Board import no longer adds “Jobapp Status” to every application’s notes.
- Fixed: an interview title longer than 191 characters is shortened to fit. Before, scheduling failed with “Could not save the interview.”
- Fixed: a note made only of invisible characters says “The note is empty.” instead of a generic error.
- Fixed: a CSV import, or a CV on Add application, that is larger than the server’s upload limit now usually goes back to its form with the “too large” message instead of a blank page.
- Fixed: if removing all applicant data leaves a CV behind, its folder keeps its protection files.
- Fixed: Site Health no longer reports outbound requests as blocked when the site can still reach itself, and names a block_local_requests filter when that is the cause.
- Fixed: a job whose title is only invisible characters shows as “(no title)” in filters and on the board.
- Fixed: the support report lists the modules that are actually running, and a module that fails to load no longer causes a “translation loading triggered too early” notice.
- Fixed: the Tools screen runs three fewer database queries.
- Changed: REST API. A rating outside 0 to 4 is refused, a stale expected rating returns a conflict, an interview created without a length uses the default from your settings, and conflict responses all have the same shape.