3 ms·

Not anymore, but I ran an in-house shared hosting environment for Wordpress sites for years. We leased hardware from Rackspace, ran VMs on top, and directly man

Not anymore, but I ran an in-house shared hosting environment for Wordpress sites for years. We leased hardware from Rackspace, ran VMs on top, and directly managed WP on the LAMP stack. The first key to WP application security is to stick to popular plugins and install patches as fast as possible. The vast, vast majority of Wordpress problems involved known vulnerabilities. “Fail secure” was our approach: better to install patches ASAP and then deal with side effects, than to defer too long and risk getting hacked. The 2nd key is to configure caching and use a CDN partner to soak up load and defend against DDOS. We used DosArrest but I think Cloudflare would be the obvious choice these days. If you want to be even more secure, don’t let WP write to its own application files except for a few minutes when you’re installing updates. But, this is not standard and therefore a pain to manage. Or, do what we did and get out of the hosting business. All our WP sites run at WP Engine now and they take care of a ton of performance and security work for us. Still have to stay on top of patches though.

Tijdreiziger 5y ago
Thanks for the advice. Yeah, the plugin situation is something I'm trying to get on top of. One of the reasons I feel the site was shoddily built is that it came with two dozen (active and inactive) plugins, half of which are seemingly configured incorrectly. I've got rid of the inactive plugins, but I still need to look into the active plugins and get rid of the unnecessary ones. Caching is something I've been wanting to look into too. Don't know if I'll go the CDN route right away, but I'll keep it in mind. Looked at WP Engine pricing and they seem pretty expensive (the company wants to replace a few more of their outdated sites with WP, so I think that would put us in the €110/mo tier). It's a small company and their websites aren't heavily patronized, so performance isn't really critical. The main consideration is not getting pwned.

Tijdreiziger 5y ago

Thanks for the advice. Yeah, the plugin situation is something I'm trying to get on top of. One of the reasons I feel the site was shoddily built is that it came with two dozen (active and inactive) plugins, half of which are seemingly configured incorrectly. I've got rid of the inactive plugins, but I still need to look into the active plugins and get rid of the unnecessary ones. Caching is something I've been wanting to look into too. Don't know if I'll go the CDN route right away, but I'll keep it in mind. Looked at WP Engine pricing and they seem pretty expensive (the company wants to replace a few more of their outdated sites with WP, so I think that would put us in the €110/mo tier). It's a small company and their websites aren't heavily patronized, so performance isn't really critical. The main consideration is not getting pwned.