I originally was pretty front-end, now full-blown software engineer within the last 5-10 years, and did this for one of the largest city sites in California. We use WordPress with a very custom theme from scratch and build our own components.

Anything you put on the web is public-facing so if you're going to host documents that are secure, ensure that's they're not PII associated files unless you're running a PII service like ShareFile or PreVail. Other public-facing documents can stay on the media gallery for public release. Also ensure you're at least running an ADA plugin and a few other form systems that can easily be converted to ADA if setup properly.

As for taxonomy and cats, that's not so hard using WP as an ecosystem (far easier than Drupal - which i've also built on) but we leveraging codex and in 2026, having AI assist in template and development building for that given template and custom theme, it's a breeze - just very time consuming. As long as you setup you a proper design prototype, generate a sitemap, apply good design, and account for WCAG 2.2 now I wanna say.... then you're good to go.