3 ms·

The biggest issue I see with Wordpress is the free plugins. I've seen more Wordpress sites hacked by way of poorly written plugins than anything else. If they

The biggest issue I see with Wordpress is the free plugins. I've seen more Wordpress sites hacked by way of poorly written plugins than anything else. If they had some sort of robust security screening process for the plugins it might be OK... but as it stands, there's far too many plugins floating around written by people who seem to have zero knowledge of basic web app security. Honestly, I think you're better off just writing your own blog software. Obscure it, close source it, lock down DB permissions and put it on your own VPS, you could knock out a simple platform in a weekend. And you're much less likely to get hit by hackers.

jacobwg 15y ago
Yeah, free plugins are both a blessing and a curse, though the majority of the common WordPress plugins (the common ones) are quite secure and are regularly updated. Obviously you can't install just any plugin without doing some research. Obviously you have to be a programmer to roll your own blogging platform so that option is not for everyone, but you'd be reinventing a wheel being run on 70 million websites for the stated reason of writing something that is more secure? You'd have to be REALLY good at what you do compared to the 1000s of WP developers contributing to WP, the dedicated security team, and the hivemind of bug-reporting WP installations. Plus, when you do encounter a security vulnerability (not if you do), it will be your sole responsibility to patch the hole. Closed-source is not a security solution - security by obscurity is no security at all. I do not think that rolling your own blog platform is a bad idea as it's a great learning experience, but it is not a good solution if you are concerned about blog security.
- jacques_chester 15y ago
  The number one focus of Wordpress is features. Shiny new features. Performance and security come a very distant second and third in this picture. Wordpress still has no unit testing. It still forces you to upgrade a version to get bugfixes and security patches. It relies entirely on beta testers to find data-destroying bugs. And it's increasingly being transformed into a catspaw for Automattic. I've been administering Wordpress for 6 or 7 years. And I hate its guts. I hate its developers. And I hate that it's an absolute triumph of Worse is Better.

jacobwg 15y ago

Yeah, free plugins are both a blessing and a curse, though the majority of the common WordPress plugins (the common ones) are quite secure and are regularly updated. Obviously you can't install just any plugin without doing some research. Obviously you have to be a programmer to roll your own blogging platform so that option is not for everyone, but you'd be reinventing a wheel being run on 70 million websites for the stated reason of writing something that is more secure? You'd have to be REALLY good at what you do compared to the 1000s of WP developers contributing to WP, the dedicated security team, and the hivemind of bug-reporting WP installations. Plus, when you do encounter a security vulnerability (not if you do), it will be your sole responsibility to patch the hole. Closed-source is not a security solution - security by obscurity is no security at all. I do not think that rolling your own blog platform is a bad idea as it's a great learning experience, but it is not a good solution if you are concerned about blog security.

jacques_chester 15y ago
The number one focus of Wordpress is features. Shiny new features. Performance and security come a very distant second and third in this picture. Wordpress still has no unit testing. It still forces you to upgrade a version to get bugfixes and security patches. It relies entirely on beta testers to find data-destroying bugs. And it's increasingly being transformed into a catspaw for Automattic. I've been administering Wordpress for 6 or 7 years. And I hate its guts. I hate its developers. And I hate that it's an absolute triumph of Worse is Better.