Single-machine server software architectures are insecure

A typical example would be Wordpress. The application has a user side and an admin console. Since they are both run by the same web server instance, the slightest error in programming the user side will give the attacker admin privileges. Coding errors are inevitable. Therefore, on the long run, privilege escalation is inevitable as well. The web server instance running the user application should never be in a position that it could acquire admin privileges. Therefore, you always need two web server instances. At the very least, the admin console should run on another port using another system user. But even then, the user side code should not have unfettered access to the database. It must be locked down to the operations that are permissible to it. The database permission system is generally not capable of enforcing that kind of lockdown. Therefore, it is necessary to funnel its requests through a network API or else (unusual) a setuid program, which are capable of enforcing the lockdown. A single-machine server is inherently insecure. One coding error will allow the attacker to gain all possible privileges on the application and inflict maximum damage. Server software must always be a distributed system, with at least two machines involved.