3 ms·

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP spac

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin. There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'. The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on). [1] https://github.com/SpiderLabs/ModSecurity https://github.com/SpiderLabs/ModSecurity [2] https://perishablepress.com/7g-firewall/ https://perishablepress.com/7g-firewall/ [3] https://www.wordfence.com/ https://www.wordfence.com/

deleted 4y ago
[deleted]
mpol 4y ago
The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great. The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.
- Tijdreiziger 4y ago
  Thanks, I'll check out the Wordfence blog! I'm definitely trying to stay on top of updates and backups (nobody had been maintaining it before I took over, so the update situation was dire). Yeah, since the performance on the current host is dire, I've been debating whether to go with another shared host or to just go the VPS route. The company wants to get into Microsoft 365 for e-mail/files, so maybe Azure is another option. I'm okay with spending some time setting things up, but I definitely don't want to have to put a lot of effort into ongoing maintenance.
snowwrestler 4y ago
Not anymore, but I ran an in-house shared hosting environment for Wordpress sites for years. We leased hardware from Rackspace, ran VMs on top, and directly managed WP on the LAMP stack. The first key to WP application security is to stick to popular plugins and install patches as fast as possible. The vast, vast majority of Wordpress problems involved known vulnerabilities. “Fail secure” was our approach: better to install patches ASAP and then deal with side effects, than to defer too long and risk getting hacked. The 2nd key is to configure caching and use a CDN partner to soak up load and defend against DDOS. We used DosArrest but I think Cloudflare would be the obvious choice these days. If you want to be even more secure, don’t let WP write to its own application files except for a few minutes when you’re installing updates. But, this is not standard and therefore a pain to manage. Or, do what we did and get out of the hosting business. All our WP sites run at WP Engine now and they take care of a ton of performance and security work for us. Still have to stay on top of patches though.
- Tijdreiziger 4y ago
  Thanks for the advice. Yeah, the plugin situation is something I'm trying to get on top of. One of the reasons I feel the site was shoddily built is that it came with two dozen (active and inactive) plugins, half of which are seemingly configured incorrectly. I've got rid of the inactive plugins, but I still need to look into the active plugins and get rid of the unnecessary ones. Caching is something I've been wanting to look into too. Don't know if I'll go the CDN route right away, but I'll keep it in mind. Looked at WP Engine pricing and they seem pretty expensive (the company wants to replace a few more of their outdated sites with WP, so I think that would put us in the €110/mo tier). It's a small company and their websites aren't heavily patronized, so performance isn't really critical. The main consideration is not getting pwned.
throw0101a 4y ago
Depending on the site, ask yourself "How dynamic does it actually have to be?". Perhaps using the GUI to update the content, and then creating static files and serving those may be an option: * https://wp2static.com https://wp2static.com * https://www.wordpress.org/plugins/simply-static/ https://www.wordpress.org/plugins/simply-static/ * https://blog.hubspot.com/website/create-a-static-website-using-wordpress https://blog.hubspot.com/website/create-a-static-website-usi...

deleted 4y ago

[deleted]

mpol 4y ago

The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great. The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.

Tijdreiziger 4y ago
Thanks, I'll check out the Wordfence blog! I'm definitely trying to stay on top of updates and backups (nobody had been maintaining it before I took over, so the update situation was dire). Yeah, since the performance on the current host is dire, I've been debating whether to go with another shared host or to just go the VPS route. The company wants to get into Microsoft 365 for e-mail/files, so maybe Azure is another option. I'm okay with spending some time setting things up, but I definitely don't want to have to put a lot of effort into ongoing maintenance.

snowwrestler 4y ago

Not anymore, but I ran an in-house shared hosting environment for Wordpress sites for years. We leased hardware from Rackspace, ran VMs on top, and directly managed WP on the LAMP stack. The first key to WP application security is to stick to popular plugins and install patches as fast as possible. The vast, vast majority of Wordpress problems involved known vulnerabilities. “Fail secure” was our approach: better to install patches ASAP and then deal with side effects, than to defer too long and risk getting hacked. The 2nd key is to configure caching and use a CDN partner to soak up load and defend against DDOS. We used DosArrest but I think Cloudflare would be the obvious choice these days. If you want to be even more secure, don’t let WP write to its own application files except for a few minutes when you’re installing updates. But, this is not standard and therefore a pain to manage. Or, do what we did and get out of the hosting business. All our WP sites run at WP Engine now and they take care of a ton of performance and security work for us. Still have to stay on top of patches though.

Tijdreiziger 4y ago
Thanks for the advice. Yeah, the plugin situation is something I'm trying to get on top of. One of the reasons I feel the site was shoddily built is that it came with two dozen (active and inactive) plugins, half of which are seemingly configured incorrectly. I've got rid of the inactive plugins, but I still need to look into the active plugins and get rid of the unnecessary ones. Caching is something I've been wanting to look into too. Don't know if I'll go the CDN route right away, but I'll keep it in mind. Looked at WP Engine pricing and they seem pretty expensive (the company wants to replace a few more of their outdated sites with WP, so I think that would put us in the €110/mo tier). It's a small company and their websites aren't heavily patronized, so performance isn't really critical. The main consideration is not getting pwned.

throw0101a 4y ago

Depending on the site, ask yourself "How dynamic does it actually have to be?". Perhaps using the GUI to update the content, and then creating static files and serving those may be an option: * https://wp2static.com https://wp2static.com * https://www.wordpress.org/plugins/simply-static/ https://www.wordpress.org/plugins/simply-static/ * https://blog.hubspot.com/website/create-a-static-website-using-wordpress https://blog.hubspot.com/website/create-a-static-website-usi...