6 ms·

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

ianlevesque 2y ago
Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.
- sunaookami 2y ago
  Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.
  - carlosjobim 2y ago
    There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.
    - aaronbaugher 2y ago
      Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past for such situations, but it was too complicated for them. That was years ago, so maybe it's better now.
      - tyteen4a03 1y ago
        You need to build your own frontend, but PayloadCMS is my go-to.
      - shakna 2y ago
        I've had some luck using Decap for that. An initial dev setup, followed by almost never needing support from the PR team running it. [0] https://decapcms.org/ https://decapcms.org/
      - donnachangstein 2y ago
        > Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Somehow I feel we have regressed from that simplicity, with nothing but hand waving to make up for it. This method was declared "obsolete" and ... Wordpress kludges took its place as somehow "better". Someone prove me wrong.
        13_9_7_7_5_18 2y ago
        [dead]
        bigfatkitten 2y ago
        A previous workplace of mine did the same with Netscape (and later, Mozilla) Composer. Users could modify content via WebDAV.
        shakna 2y ago
        Part of that is Frontpage needing a Windows server, and all that entails. The other part is clients freaking out after Frontpage had a series of dangerous CVEs all in a row. And then finally every time a part of Frontpage got popular, MS would deprecate the API and replace it with a new one. Wordpress was in the right place at the right time.
    - wincy 2y ago
      I do custom web dev so am way out of the website hosting game. What are good frameworks now if I want to say, light touch help someone who is slightly technical set up a website? Not full react SPA with an API.
      - carlosjobim 2y ago
        By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of similar magnitude, then you have to ask somebody else than me.
        felbane 2y ago
        Does anyone actually still use jQuery? Everything I've built in the past like 5 years has been almost entirely pure ES6 with some helpers like jsviews.
        karaterobot 2y ago
        jQuery's still the third most used web framework, behind React and before NextJS. If you use jQuery to build Wordpress websites, you'd be specializing in popular web technologies in the year 2025. https://survey.stackoverflow.co/2024/technology#1-web-frameworks-and-technologies https://survey.stackoverflow.co/2024/technology#1-web-framew...
        carlosjobim 2y ago
        Sure, why not? It's lightweight and works well, and there's a lot of good solutions that you can find already made for you online.
        nophunphil 2y ago
        jQuery hasn’t been necessary for many years. Vanilla JS equivalents of jQuery code are well-supported. https://youmightnotneedjquery.com/ https://youmightnotneedjquery.com/
    - dmje 2y ago
      Just not true, although entirely aligned with HN users who often believe that the levels of nerdery on HN are common in the real world. WP isn’t bad, you’ve just done it wrong, and there really isn’t a better alternative for hundreds and hundreds of use cases..
      - carlosjobim 2y ago
        My perspective is that WordPress is too complicated and too nerdy for most real world users. They are usually better off with a solution that is tailor made for their use case. And there's plenty of such solutions. Even for blogging, there are much better solutions than WordPress for non-technical users.
        dmje 1y ago
        Totally disagree! If you're non technical: wordpress.com - choose site name, create account, make website. Then if you want to grow you can pay for a domain, custom plugins, themes, shop. If you really want to grow then you can bring your data out and setup your own (or pay someone to setup) a wordpress.org instance. Thousands of options for hosting, themes, whatever. And: compared to the other builders like Wix, Squarespace etc, you're not locked in. If you make a thing on wordpress.com or wordpress.org and want to escape, you just export your stuff in a common XML format. You get none of that with the commercial options. So, yeh, however much HN likes to hate on it, it's still the best platform of choice for non-technicals to get stuff on the web.
    - hombre_fatal 2y ago
      You can use WordPress as a static site generator: https://simplystatic.com/ https://simplystatic.com/ Then WordPress is just your private CMS/UI for making changes, and it generates static files that are uploaded to a webhost like CloudFlare Pages, GitHub Pages, etc.
      - sureIy 2y ago
        It has been a long time since I tried that, but it was never as simple as they claimed it to be. Now that plugin became a service, at which point you might just use a WP host and let them do their thing.
        hombre_fatal 2y ago
        Yeah, true. There are other options that might be better like https://wordpress.org/plugins/staatic/ https://wordpress.org/plugins/staatic/. I think a crawler that generates a static directory from your site probably the best approach since it generalizes over any site. Even better if you're able to declare all routes ahead of time.
  - ozim 2y ago
    I have better things to do with my time so I happily pay someone else to host it for me.
- arcfour 2y ago
  Never use that junk if you value your sanity, I think you mean.
- ufmace 2y ago
  Ditto to self-hosting wordpress works fine with standard hosting practices and not installing a bazillion random plugins.
- UltraSane 2y ago
  I once worked for a US state government agency and my coworker was the main admin of our WordPress based portal and it was crazy how much work it was to keep working.
protocolture 2y ago
>Take over a wordpress site for a customer >Oh look 3 separate php shells with random strings as a name Never less than 3, but always guaranteed.
colechristensen 2y ago
>after 1 hour I've used this teaching folks devops, here deploy your first hello world nginx server... huh what are those strange requests in the log?
dx4100 2y ago
There's ways that prevent it - - Freeze all code after an update through permissions - Don't make most directories writeable - Don't allow file uploads, or limit file uploads to media There's a few plugins that do this, but vanilla WP is dangerous.
maeln 2y ago
I never hosted WP, but as soon as you have a HTTP server expose to the internet you will get request to /wp-login and such. It as become a good way to find bots also. If I see an IP requesting anything from a popular CMS, hop it goes in the iptables holes
- Perz1val 2y ago
  Hey, I check /wp-admin sometimes when I see a website and it has a certain feel to it
- victorbjorklund 2y ago
  I do the same. Great way to filter our security scanners.
Aransentin 2y ago
Wordpress is indeed a nice backdoor, it even has CMS functionality built in.

ianlevesque 2y ago

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

sunaookami 2y ago
Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.
- carlosjobim 2y ago
  There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.
  - aaronbaugher 2y ago
    Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past for such situations, but it was too complicated for them. That was years ago, so maybe it's better now.
    - tyteen4a03 1y ago
      You need to build your own frontend, but PayloadCMS is my go-to.
    - shakna 2y ago
      I've had some luck using Decap for that. An initial dev setup, followed by almost never needing support from the PR team running it. [0] https://decapcms.org/ https://decapcms.org/
    - donnachangstein 2y ago
      > Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Somehow I feel we have regressed from that simplicity, with nothing but hand waving to make up for it. This method was declared "obsolete" and ... Wordpress kludges took its place as somehow "better". Someone prove me wrong.
      - 13_9_7_7_5_18 2y ago
        [dead]
      - bigfatkitten 2y ago
        A previous workplace of mine did the same with Netscape (and later, Mozilla) Composer. Users could modify content via WebDAV.
      - shakna 2y ago
        Part of that is Frontpage needing a Windows server, and all that entails. The other part is clients freaking out after Frontpage had a series of dangerous CVEs all in a row. And then finally every time a part of Frontpage got popular, MS would deprecate the API and replace it with a new one. Wordpress was in the right place at the right time.
  - wincy 2y ago
    I do custom web dev so am way out of the website hosting game. What are good frameworks now if I want to say, light touch help someone who is slightly technical set up a website? Not full react SPA with an API.
    - carlosjobim 2y ago
      By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of similar magnitude, then you have to ask somebody else than me.
      - felbane 2y ago
        Does anyone actually still use jQuery? Everything I've built in the past like 5 years has been almost entirely pure ES6 with some helpers like jsviews.
        karaterobot 2y ago
        jQuery's still the third most used web framework, behind React and before NextJS. If you use jQuery to build Wordpress websites, you'd be specializing in popular web technologies in the year 2025. https://survey.stackoverflow.co/2024/technology#1-web-frameworks-and-technologies https://survey.stackoverflow.co/2024/technology#1-web-framew...
        carlosjobim 2y ago
        Sure, why not? It's lightweight and works well, and there's a lot of good solutions that you can find already made for you online.
      - nophunphil 2y ago
        jQuery hasn’t been necessary for many years. Vanilla JS equivalents of jQuery code are well-supported. https://youmightnotneedjquery.com/ https://youmightnotneedjquery.com/
  - dmje 2y ago
    Just not true, although entirely aligned with HN users who often believe that the levels of nerdery on HN are common in the real world. WP isn’t bad, you’ve just done it wrong, and there really isn’t a better alternative for hundreds and hundreds of use cases..
    - carlosjobim 2y ago
      My perspective is that WordPress is too complicated and too nerdy for most real world users. They are usually better off with a solution that is tailor made for their use case. And there's plenty of such solutions. Even for blogging, there are much better solutions than WordPress for non-technical users.
      - dmje 1y ago
        Totally disagree! If you're non technical: wordpress.com - choose site name, create account, make website. Then if you want to grow you can pay for a domain, custom plugins, themes, shop. If you really want to grow then you can bring your data out and setup your own (or pay someone to setup) a wordpress.org instance. Thousands of options for hosting, themes, whatever. And: compared to the other builders like Wix, Squarespace etc, you're not locked in. If you make a thing on wordpress.com or wordpress.org and want to escape, you just export your stuff in a common XML format. You get none of that with the commercial options. So, yeh, however much HN likes to hate on it, it's still the best platform of choice for non-technicals to get stuff on the web.
  - hombre_fatal 2y ago
    You can use WordPress as a static site generator: https://simplystatic.com/ https://simplystatic.com/ Then WordPress is just your private CMS/UI for making changes, and it generates static files that are uploaded to a webhost like CloudFlare Pages, GitHub Pages, etc.
    - sureIy 2y ago
      It has been a long time since I tried that, but it was never as simple as they claimed it to be. Now that plugin became a service, at which point you might just use a WP host and let them do their thing.
      - hombre_fatal 2y ago
        Yeah, true. There are other options that might be better like https://wordpress.org/plugins/staatic/ https://wordpress.org/plugins/staatic/. I think a crawler that generates a static directory from your site probably the best approach since it generalizes over any site. Even better if you're able to declare all routes ahead of time.
- ozim 2y ago
  I have better things to do with my time so I happily pay someone else to host it for me.
arcfour 2y ago
Never use that junk if you value your sanity, I think you mean.
ufmace 2y ago
Ditto to self-hosting wordpress works fine with standard hosting practices and not installing a bazillion random plugins.
UltraSane 2y ago
I once worked for a US state government agency and my coworker was the main admin of our WordPress based portal and it was crazy how much work it was to keep working.

protocolture 2y ago

>Take over a wordpress site for a customer >Oh look 3 separate php shells with random strings as a name Never less than 3, but always guaranteed.

colechristensen 2y ago

>after 1 hour I've used this teaching folks devops, here deploy your first hello world nginx server... huh what are those strange requests in the log?

dx4100 2y ago

There's ways that prevent it - - Freeze all code after an update through permissions - Don't make most directories writeable - Don't allow file uploads, or limit file uploads to media There's a few plugins that do this, but vanilla WP is dangerous.

maeln 2y ago

I never hosted WP, but as soon as you have a HTTP server expose to the internet you will get request to /wp-login and such. It as become a good way to find bots also. If I see an IP requesting anything from a popular CMS, hop it goes in the iptables holes

Perz1val 2y ago
Hey, I check /wp-admin sometimes when I see a website and it has a certain feel to it
victorbjorklund 2y ago
I do the same. Great way to filter our security scanners.

Aransentin 2y ago

Wordpress is indeed a nice backdoor, it even has CMS functionality built in.