3 ms·
The problem with WP is that its being run in a privileged position. A statically generated site is not.
by fastball 5y ago
The problem with WP is that its being run in a privileged position. A statically generated site is not.
- post-it 5y agoYou shouldn't run your web server as root. I think the most common way of running WordPress is to use nginx in front of Apache, so you can easily run Apache as a special WordPress user for extra security.
- fastball 5y agoSorry, my terminology wasn't clear. Didn't really mean running it as root, meant that WP has direct access to your DB (it must).
- post-it 5y agoEvery backend has access to your DB though. If a WordPress alternative supports plugins, it is just as vulnerable. If it doesn't support plugins, it's not a WordPress alternative for most use cases.
- sdze 5y agoyou don't run your fpm processes as superuser. In general it is run in a jailed environment.