4 ms·
> The core WordPress is one of the most secure software in the world: there are thousands of people trying all the time to find exploits and the codebase is pub
by bzzzt 4y ago
> The core WordPress is one of the most secure software in the world: there are thousands of people trying all the time to find exploits and the codebase is public. Go take a look at what CMS whitehouse.gov (one of the highest-profile hacking targets out there) is using.
While I believe the core is reasonably secure, lots of plugins and webhosts aren't. Simply making the website code read-only would take care of a lot of issues, but then your auto-update won't work.
- angst_ridden 4y agoYou can make the the code read-only (from the web-server's perspective) and have auto update if you use a tool like WP-CLI and a cron job. I've had a few customer's sites on WP for decades without any hacks. But I also carefully restrict their plug-ins, and disable PHP in any of the upload directories.