6 ms·

I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go thro

I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go through the wizard and install a new Wordpress, adding credentials, giving it a name etc. It was a lulzy thing to do but I wouldn't do it again. Back in the day you got very bored. If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

rahimnathwani 4y ago
> If I was setting up my own Wordpress > I would go through the wizard as quickly as possible You might not be quicker than a bot.
salawat 4y ago
I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.
- UI_at_80x24 4y ago
  I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.
- db48x 4y ago
  Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.
  - apocalyptic0n3 4y ago
    Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.
    - earleybird 4y ago
      because their IT group "would just slow us down"
    - Tijdreiziger 4y ago
      IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.
    - db48x 4y ago
      That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.
- Kalium 4y ago
  If you're unfamiliar with the nuances of good development practices or basic security, this is an obvious thing to do. It lets you iterate and work on it until you're ready. It doesn't even occur to a lot of people that this might be a bad idea. Salespeople, marketing, a sole prop, or someone who wants to set up a blog are all people who would have absolutely no idea how to do this right... and no clue that they're doing it wrong.
  - snowwrestler 4y ago
    Ok sure, but these are also somehow people who are requesting and installing TLS certs? I’m just flummoxed trying to imagine a person who can install and run certbot, but doesn’t know how to (or think to) configure locally, or even set a basic HTTP password on the site until WP is configured.
    - Kalium 4y ago
      Yes, because that's the sort of thing that's easily automated and can be done for you by a setup script. Or by following a stepwise tutorial. People don't have to understand what they're doing to use a tool. Sometimes, like this time, there can be drawbacks to this.
deleted 4y ago
[deleted]
rascul 4y ago
> If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it. Do it offline, or on a private subnet, or whitelist your IP, or well anything you can to keep the world away from your install until you have it setup. Or, if possible, don't install WordPress.

rahimnathwani 4y ago

> If I was setting up my own Wordpress > I would go through the wizard as quickly as possible You might not be quicker than a bot.

salawat 4y ago

I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.

UI_at_80x24 4y ago
I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.
db48x 4y ago
Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.
- apocalyptic0n3 4y ago
  Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.
  - earleybird 4y ago
    because their IT group "would just slow us down"
  - Tijdreiziger 4y ago
    IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.
  - db48x 4y ago
    That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.
Kalium 4y ago
If you're unfamiliar with the nuances of good development practices or basic security, this is an obvious thing to do. It lets you iterate and work on it until you're ready. It doesn't even occur to a lot of people that this might be a bad idea. Salespeople, marketing, a sole prop, or someone who wants to set up a blog are all people who would have absolutely no idea how to do this right... and no clue that they're doing it wrong.
- snowwrestler 4y ago
  Ok sure, but these are also somehow people who are requesting and installing TLS certs? I’m just flummoxed trying to imagine a person who can install and run certbot, but doesn’t know how to (or think to) configure locally, or even set a basic HTTP password on the site until WP is configured.
  - Kalium 4y ago
    Yes, because that's the sort of thing that's easily automated and can be done for you by a setup script. Or by following a stepwise tutorial. People don't have to understand what they're doing to use a tool. Sometimes, like this time, there can be drawbacks to this.

deleted 4y ago

[deleted]

rascul 4y ago

> If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it. Do it offline, or on a private subnet, or whitelist your IP, or well anything you can to keep the world away from your install until you have it setup. Or, if possible, don't install WordPress.