3 ms·
Using WordPress for a simple read-only blog is OK: security is not as major a concern. Once you're taking signups, the quality and security record of the under
by lucideer 10y ago
Using WordPress for a simple read-only blog is OK: security is not as major a concern.
Once you're taking signups, the quality and security record of the underlying software is worth considering more carefully, and I just personally would not choose WordPress where those are requirements.
- tomcam 10y agoAuth code looks ok to me but I am not a PHP expert. Could find no major recent breaches--am I missing something? (Not being snarky, just trying to understand the issue.)
- lucideer 10y agoWordPress the app is inherently unsecure in many ways. A full overview would be lengthy, but an obvious example is the general architectural reliance on self-modifying code, which requires write access to executable files on your server (this can be disabled with some difficulty, but this makes updates difficult and completely breaks many popular plugins. Doing so is not encouraged or really properly supported by WP devs). This isn't the only problem, but it's a large enough one, and most importantly, it's by design. Auth code might look OKish (haven't looked closely recently), but any general vulnerability in any part of the app as a whole or in any 3rd-party plugins potentially opens you up to data breaches.