4 ms·

This comment is a load of nonsense. Wordpress core has regular and comprehensive security reviews. Wordpress is the most deployed publishing platform globally.

This comment is a load of nonsense. Wordpress core has regular and comprehensive security reviews. Wordpress is the most deployed publishing platform globally. Like with any web application you should be deploying it behind a Web application firewall with a fit for purpose ruleset, and additionally with wordpress you can integrate one of several application firewalls into the application - several of which have decent full time security and development teams that actively discover, patch and mitigate zero days and new exploits. Anything you add beyond that is on you, and you should be vetting your vendors or own code properly. I have to wonder what your purpose for attack here is. Are you developing a competing product?

kevincox 5y ago
I don't know enough to comment about WordPress. But a secure applications don't need a WAF to be secure. WAFs in the steady-state are really just fuzzy bug injectors that hope to inject bugs over top of exploitable code. The main use for WAFs that I consider valid is emergency response to recently discovered vulnerabilities while a patch is being discovered and applied. The other use case is external rate limiting and DoS protection. But most often it is better to do that in the app anyways.
- anakaine 5y ago
  They do plenty more than that: - Can section off certain requests - Can rate limit - Can catch basic injection attacks With the wafs that integrate with WP such as wordfence they can also do things like: - Check for bad file permissions - Check for bad web server configuration - Recieve ruleset updates for zero days that are actually threat surface specific Having a WAF in place that is threat surface specific isn't as much about saying "its not needed if the code is good" as much as it is saying "the code might not always be good. We are not perfect. I'm at least going to have an extra layer or two of defence to try and stay safe(r) and give me some breathing room between an exploit and a patch".
kichimi 5y ago
It's just the oft touted "WordPress is insecure" meme.
Apofis 5y ago
Okay, I won't argue with you. You are clearly a Wordpress Architect.
- Apofis 5y ago
  Alright, who's the funny guy? https://i.ibb.co/Xpbm1hR/funny-guy.png https://i.ibb.co/Xpbm1hR/funny-guy.png

kevincox 5y ago

I don't know enough to comment about WordPress. But a secure applications don't need a WAF to be secure. WAFs in the steady-state are really just fuzzy bug injectors that hope to inject bugs over top of exploitable code. The main use for WAFs that I consider valid is emergency response to recently discovered vulnerabilities while a patch is being discovered and applied. The other use case is external rate limiting and DoS protection. But most often it is better to do that in the app anyways.

anakaine 5y ago
They do plenty more than that: - Can section off certain requests - Can rate limit - Can catch basic injection attacks With the wafs that integrate with WP such as wordfence they can also do things like: - Check for bad file permissions - Check for bad web server configuration - Recieve ruleset updates for zero days that are actually threat surface specific Having a WAF in place that is threat surface specific isn't as much about saying "its not needed if the code is good" as much as it is saying "the code might not always be good. We are not perfect. I'm at least going to have an extra layer or two of defence to try and stay safe(r) and give me some breathing room between an exploit and a patch".

kichimi 5y ago

It's just the oft touted "WordPress is insecure" meme.

Apofis 5y ago

Okay, I won't argue with you. You are clearly a Wordpress Architect.

Apofis 5y ago
Alright, who's the funny guy? https://i.ibb.co/Xpbm1hR/funny-guy.png https://i.ibb.co/Xpbm1hR/funny-guy.png