8 ms·

Come on guys -- it's been a while. We oversee or advise on blogs for basically every major media site (CNN, WSJ, NYT, IHT, TechCrunch, GigaOM...) as well as run

Come on guys -- it's been a while. We oversee or advise on blogs for basically every major media site (CNN, WSJ, NYT, IHT, TechCrunch, GigaOM...) as well as running WordPress myself (and WP.org) for 7+ years and have never had an application level exploit. If WP was really as insecure as you suggest, all of the news sites would look like 4chan. It's possible to run WP in a secure manner. Just because some people don't doesn't mean you can't. It doesn't require crazy wget hacks, just updating. You can even automate it with SVN. If anyone has questions or would like best practices for running WP in a secure manner, I'd be happy to answer them, here or over email -- m@mullenweg.com.

dcurtis 16y ago
You should make running WordPress securely a thoughtless process. The best practices should be clearly explained to every single user who downloads/installs it.
- photomatt 16y ago
  Sure -- the simplest way to keep it secure is just keep it updated. To this end we work with numerous third-party hosts to help them update their customers, and have invested significantly in a notification and upgrade system for 10k+ plugins, 1k+ themes, and of course the core software. This was a particular PITA because runs on so many platforms with wildly different constraints and configurations. We blog, tweet, and email 200k people whenever there's a new release and offer free help on our forums to anyone who is stuck. Someday we might even offer auto-update in core just like many hosts already do. My comment was more aimed at the HN audience which might want pro tips for staying updated or more defense in depth. For example I have a cron job run `svn up` on my site every morning which keeps it up to date whether I'm in front of my computer or on a beach sipping mai tais.
  - chaosmachine 16y ago
    "I have a cron job run `svn up` on my site every morning" Can you really trust that not to randomly break your site? Surely you'll run into regressions or backwards-incompatibilities at some point?
    - photomatt 16y ago
      What I suggest for most folks is to tie it to a stable branch, that way you get overnight fixes but nothing potentially backward-incompatible. When a major release comes out, you need to svn switch to the new branch. Many folks in the WP community, including myself, svn up to trunk. I wouldn't recommend that for the general public, but I think it's only broken my site once in the past year and I fixed it by running svn up again. If I was smarter I would script it to svn up, check the site, revert if it was blank. WP.com syncs to WordPress trunk pretty regularly, as well, sometimes daily depending on where WP is in its release cycle or if we have to do any database migrations.
- thenbrent 16y ago
  You're trying to say WordPress is to blame for not making server administration, across multiple * nix flavours thougthless. WordPress has secure defaults and the codex does a good job of providing instructions if you really want to go modifying the default. There will always be tutorials out there saying chmod 777 * Rookie users will follow these tutorials and then blame WP because they find a whole bunch of malicious scripts show up in their wordpress directory. EDIT: formatting
ryanjkirk 16y ago
Has Automattic or wordpress.org published anything like the various guides found across the internet? I know you offered to email, but it would be great to see something published that is tested and comprehensive.
- photomatt 16y ago
  Sure, this page is pretty comprehensive: http://codex.wordpress.org/Hardening_WordPress http://codex.wordpress.org/Hardening_WordPress (And much is applicable to many web apps besides WordPress.)
  - ryanjkirk 16y ago
    I've seen this page before but actually thought it to be fairly basic. What about topics such as moving wp-config.php outside of public_html, renaming the wp-admin folder, and automattic's position on some of the various 3rd-party security plugins? One thing I don't understand, is why I can't access the admin over SSL if the Wordpress domain isn't the Apache SSL domain? For example, I can't go to https://example.com/domains/mydomain.com/wp-admin/ https://example.com/domains/mydomain.com/wp-admin/ without getting a failed redirect. This is a major annoyance, as I can't set up another SSL site on the server without leasing another IP.
    - photomatt 16y ago
      Moving wp-config.php out of public_html is mentioned on that page, section 9. I think renaming the wp-admin would probably break more than it protects. Not sure on the second question.
      - ryanjkirk 16y ago
        Don't get me wrong, I love WordPress. And I can't stand Joomla. But Joomla works completely off relative URL's so it doesn't have to know it's location. The links work no matter what domain you put it on. You can access the CMS through example.com/~myusername/domains/joomladomain/ or myusername.example.com/domains/joomladomain/ or joomladomain.com/ and it will for fine every way. Which means SSL will work without a dedicated IP address. This would be awesome.

dcurtis 16y ago

You should make running WordPress securely a thoughtless process. The best practices should be clearly explained to every single user who downloads/installs it.

photomatt 16y ago
Sure -- the simplest way to keep it secure is just keep it updated. To this end we work with numerous third-party hosts to help them update their customers, and have invested significantly in a notification and upgrade system for 10k+ plugins, 1k+ themes, and of course the core software. This was a particular PITA because runs on so many platforms with wildly different constraints and configurations. We blog, tweet, and email 200k people whenever there's a new release and offer free help on our forums to anyone who is stuck. Someday we might even offer auto-update in core just like many hosts already do. My comment was more aimed at the HN audience which might want pro tips for staying updated or more defense in depth. For example I have a cron job run `svn up` on my site every morning which keeps it up to date whether I'm in front of my computer or on a beach sipping mai tais.
- chaosmachine 16y ago
  "I have a cron job run `svn up` on my site every morning" Can you really trust that not to randomly break your site? Surely you'll run into regressions or backwards-incompatibilities at some point?
  - photomatt 16y ago
    What I suggest for most folks is to tie it to a stable branch, that way you get overnight fixes but nothing potentially backward-incompatible. When a major release comes out, you need to svn switch to the new branch. Many folks in the WP community, including myself, svn up to trunk. I wouldn't recommend that for the general public, but I think it's only broken my site once in the past year and I fixed it by running svn up again. If I was smarter I would script it to svn up, check the site, revert if it was blank. WP.com syncs to WordPress trunk pretty regularly, as well, sometimes daily depending on where WP is in its release cycle or if we have to do any database migrations.
thenbrent 16y ago
You're trying to say WordPress is to blame for not making server administration, across multiple * nix flavours thougthless. WordPress has secure defaults and the codex does a good job of providing instructions if you really want to go modifying the default. There will always be tutorials out there saying chmod 777 * Rookie users will follow these tutorials and then blame WP because they find a whole bunch of malicious scripts show up in their wordpress directory. EDIT: formatting

ryanjkirk 16y ago

Has Automattic or wordpress.org published anything like the various guides found across the internet? I know you offered to email, but it would be great to see something published that is tested and comprehensive.

photomatt 16y ago
Sure, this page is pretty comprehensive: http://codex.wordpress.org/Hardening_WordPress http://codex.wordpress.org/Hardening_WordPress (And much is applicable to many web apps besides WordPress.)
- ryanjkirk 16y ago
  I've seen this page before but actually thought it to be fairly basic. What about topics such as moving wp-config.php outside of public_html, renaming the wp-admin folder, and automattic's position on some of the various 3rd-party security plugins? One thing I don't understand, is why I can't access the admin over SSL if the Wordpress domain isn't the Apache SSL domain? For example, I can't go to https://example.com/domains/mydomain.com/wp-admin/ https://example.com/domains/mydomain.com/wp-admin/ without getting a failed redirect. This is a major annoyance, as I can't set up another SSL site on the server without leasing another IP.
  - photomatt 16y ago
    Moving wp-config.php out of public_html is mentioned on that page, section 9. I think renaming the wp-admin would probably break more than it protects. Not sure on the second question.
    - ryanjkirk 16y ago
      Don't get me wrong, I love WordPress. And I can't stand Joomla. But Joomla works completely off relative URL's so it doesn't have to know it's location. The links work no matter what domain you put it on. You can access the CMS through example.com/~myusername/domains/joomladomain/ or myusername.example.com/domains/joomladomain/ or joomladomain.com/ and it will for fine every way. Which means SSL will work without a dedicated IP address. This would be awesome.