3 ms·

We recently had to switch off WP-Engine. We were on for ~9 months and it was frustrating because there were be regular slowdowns. The responses that came back w

by jmacd 14y ago

We recently had to switch off WP-Engine. We were on for ~9 months and it was frustrating because there were be regular slowdowns. The responses that came back were things like "someone else on your server had a runaway script that was eating all the CPU" and other things that made us feel pretty vulnerable. Eventually the site became so slow so regularly that we were pretty sure we were going to switch to another host. The final straw for us though was that we had an interaction with tech support and we needed to retrieve our password. The went ahead and sent us our password in plaintext. (actually a screenshot of the password in plaintext). So, to put it mildly, blog posts like this feel like a veneer to us. Slow, vulnerable and poorly secured.

rdl 14y ago
Who else do you use, then? I actively avoid using wordpress, and even more actively avoid hosting it, because it is such a security mess. But I doubt you've moved away from wordpress itself. It would be nice to have a "good" wp hosting option. Wordpress.com seems to be the best choice at the low end, and I guess WP VIP if you are very high volume, but I haven't really made a comprehensive study.
- wow_really 14y ago
  WordPress really isn't insecure if you use it and configure it correctly.
powertower 14y ago
> The went ahead and sent us our password in plaintext. (actually a screenshot of the password in plaintext). Sounds more than reasonable to me. After you get it, then you can use it to log in, and change it.
- dpark 14y ago
  Nope. Your password shouldn't be stored in plaintext in the first place. It should be properly salted and hashed with a modern hashing function like bcrypt. Storing passwords in plaintext turns security breaches from "that's annoying" to "oops we just exposed 12 million passwords".
smartbear 14y ago
Hi this is Jason, founder of WP Engine. 1. The password is question is stored by WordPress in plaintext on disk. 2. It was transmitted to you inside our SSL-secured support system, because you requested it. 3. We maintain Pingdom reports on all our competitors, so I know for a fact that our uptime and speed is superior, in general. HOWEVER -- I do NOT DISAGREE with your characterization that you might have seen slowdowns, poor support, etc.. With 1000s of customers, one thing we see all the time is a handful who, for whatever reason, really do have a terrible experience with us at every turn -- technical and human -- and it's just bad. Of course there's the opposite end of that range of luck, and the huge majority who are happy and don't experience those things in those doses. It's always frustrating to hear that you've had that experience -- all the more because I'm sure you're not exaggerating. It's some consolation that we get praised daily on Twitter for just the opposite -- that shows we're not, in fact, just completely awful as you're implying. But not much, because it always sucks to see even one customer have a series of bad experiences as you have.
- dpark 14y ago
  Doesn't WordPress support hashed passwords? http://codex.wordpress.org/Function_Reference/wp_hash_password http://codex.wordpress.org/Function_Reference/wp_hash_passwo...
- wow_really 14y ago
  I would really like you to elaborate on how "The password is question is stored by WordPress in plaintext on disk"? If you're referring to the database password that is stored within wp-config.pnp, why is it even the same as the account password? Does the customer even have direct database access? If not, can you explain why the db password is the same and why it isn't a randomly generated pass?
- wow_really 14y ago
  So.... no reply Jason?

by jmacd 14y ago

rdl 14y ago

Who else do you use, then? I actively avoid using wordpress, and even more actively avoid hosting it, because it is such a security mess. But I doubt you've moved away from wordpress itself. It would be nice to have a "good" wp hosting option. Wordpress.com seems to be the best choice at the low end, and I guess WP VIP if you are very high volume, but I haven't really made a comprehensive study.

wow_really 14y ago
WordPress really isn't insecure if you use it and configure it correctly.

powertower 14y ago

> The went ahead and sent us our password in plaintext. (actually a screenshot of the password in plaintext). Sounds more than reasonable to me. After you get it, then you can use it to log in, and change it.

dpark 14y ago
Nope. Your password shouldn't be stored in plaintext in the first place. It should be properly salted and hashed with a modern hashing function like bcrypt. Storing passwords in plaintext turns security breaches from "that's annoying" to "oops we just exposed 12 million passwords".

smartbear 14y ago

Hi this is Jason, founder of WP Engine. 1. The password is question is stored by WordPress in plaintext on disk. 2. It was transmitted to you inside our SSL-secured support system, because you requested it. 3. We maintain Pingdom reports on all our competitors, so I know for a fact that our uptime and speed is superior, in general. HOWEVER -- I do NOT DISAGREE with your characterization that you might have seen slowdowns, poor support, etc.. With 1000s of customers, one thing we see all the time is a handful who, for whatever reason, really do have a terrible experience with us at every turn -- technical and human -- and it's just bad. Of course there's the opposite end of that range of luck, and the huge majority who are happy and don't experience those things in those doses. It's always frustrating to hear that you've had that experience -- all the more because I'm sure you're not exaggerating. It's some consolation that we get praised daily on Twitter for just the opposite -- that shows we're not, in fact, just completely awful as you're implying. But not much, because it always sucks to see even one customer have a series of bad experiences as you have.

dpark 14y ago
Doesn't WordPress support hashed passwords? http://codex.wordpress.org/Function_Reference/wp_hash_password http://codex.wordpress.org/Function_Reference/wp_hash_passwo...
wow_really 14y ago
I would really like you to elaborate on how "The password is question is stored by WordPress in plaintext on disk"? If you're referring to the database password that is stored within wp-config.pnp, why is it even the same as the account password? Does the customer even have direct database access? If not, can you explain why the db password is the same and why it isn't a randomly generated pass?
wow_really 14y ago
So.... no reply Jason?