4 ms·

Wordpress is fine if you're using wordpress.com edit: not .org (though I usually push webflow). Hosting it yourself is a mistake. Not because it's inherently i

Wordpress is fine if you're using wordpress.com edit: not .org (though I usually push webflow). Hosting it yourself is a mistake. Not because it's inherently insecure (the base install isn't) but because no one can control themselves with plugins. There's an entire cottage industry revolving around wpscan and securing/popping the millions of poorly secured wordpress instances floating around.

arkitaip 6y ago
Surely you mean wordpress.com. Also, millions of people host WordPress themselves and it works fine considering how much value it delivers.
- whatsmyusername 6y ago
  It you just want to throw up a semi static site with a couple updates a year, sure. Go nuts. The moment marketing wants to be able to login to make dynamic updates and load the instance up with plugins it's time to outsource the hosting. My team already has too much going on to spend time on this foolishness. This got especially worse with 5.x since you can't 403 the REST API off the corporate network anymore (aka the REST API that shipped vulnerable on day 1). It's used for customer facing 'stuff' now.
snowwrestler 6y ago
We self-hosted dozens of WP sites for years. It definitely requires careful attention to keep it secure and performant. As you say, one important factor was to carefully control plugins. As an in-house team, we were able to manage these on behalf of our colleagues rather than allowing a free-for-all. We switched our WP hosting to WP Engine a couple years ago and have been happy with that.
frankzander 6y ago
Crazy opinion. Thing is that if you have such problems you maybe shouldn't use WP. Well IMHO in general I wouldn't recommend WP because of this whole mess with plugins to gain some functional enhancement. I would recommend some CMSs which have a good core functionality by default.
scarecrowbob 6y ago
We host several hundred WP sites as part of our client work... it's not super hard, but then I also have a lot of experience doing it. There are plenty of commercial hosts at all price points that manage this stuff.
type0 6y ago
So, so many small and medium businesses online leaking the private customer information because of poorly made plugins. Nothing can shame them enough and the easiest solution is that they should stop using Wordpress plugins, and in that case it's better to use something else entirely.
mavhc 6y ago
This is the real problem, Wordpress doesn't care about security. Why can a bad plugin own your entire site? Why aren't half the security options for xss protection available, let alone built in. Seems impossible to automatically add hashes for 3rd party code, not use inline css, etc

arkitaip 6y ago

Surely you mean wordpress.com. Also, millions of people host WordPress themselves and it works fine considering how much value it delivers.

whatsmyusername 6y ago
It you just want to throw up a semi static site with a couple updates a year, sure. Go nuts. The moment marketing wants to be able to login to make dynamic updates and load the instance up with plugins it's time to outsource the hosting. My team already has too much going on to spend time on this foolishness. This got especially worse with 5.x since you can't 403 the REST API off the corporate network anymore (aka the REST API that shipped vulnerable on day 1). It's used for customer facing 'stuff' now.

snowwrestler 6y ago

We self-hosted dozens of WP sites for years. It definitely requires careful attention to keep it secure and performant. As you say, one important factor was to carefully control plugins. As an in-house team, we were able to manage these on behalf of our colleagues rather than allowing a free-for-all. We switched our WP hosting to WP Engine a couple years ago and have been happy with that.

frankzander 6y ago

Crazy opinion. Thing is that if you have such problems you maybe shouldn't use WP. Well IMHO in general I wouldn't recommend WP because of this whole mess with plugins to gain some functional enhancement. I would recommend some CMSs which have a good core functionality by default.

scarecrowbob 6y ago

We host several hundred WP sites as part of our client work... it's not super hard, but then I also have a lot of experience doing it. There are plenty of commercial hosts at all price points that manage this stuff.

type0 6y ago

So, so many small and medium businesses online leaking the private customer information because of poorly made plugins. Nothing can shame them enough and the easiest solution is that they should stop using Wordpress plugins, and in that case it's better to use something else entirely.

mavhc 6y ago

This is the real problem, Wordpress doesn't care about security. Why can a bad plugin own your entire site? Why aren't half the security options for xss protection available, let alone built in. Seems impossible to automatically add hashes for 3rd party code, not use inline css, etc