Hacker News Reader

Comment by lkrubner | Hacker News Reader

I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point:

WordPress has historically been a security nightmare.

Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPress are worth discussing any time that WordPress is discussed.

Certainly, when I have a freelance client, and they ask me "Should we use WordPress?" I typically answer with some long version of "It has a good admin section for non-technical users, and also designers love it, but it also has a lot of security flaws."

View on HN

I'd love to move client's mostly static sites to Pelican or Hugo. But that means that every time they want to tweak something that isn't content, I get a phone call. So I stick with locked-down* versions of Wordpress, configured to automatically update, and hope for the best. So far, I haven't had any trouble, but if a site did get hacked, I have backups on hand to deploy a new server in seconds.

*Besides best security practices for the server, database and Wordpress install, and clients aren't allowed to install new plugins or tweak the actual source code. The lightweight UI customization that themes provide is usually enough.

This is exactly the reason why I'm building Pragma (it's a static site builder with client focused UX) http://www.laktek.com/2016/11/29/introducing-pragma/

Awesome. Signed up for the beta.

Cloudcannon provides a similar service for Jekyll, which we use for our public facing site

Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse.

Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that:

https://www.youtube.com/results?q=wordpress+hack

How about putting a tool like Incapsula on top (free option offers 2 factor authentication) which makes hacking just a bit harder.

2 factor authentication is great, but it won't stop an attacker from using an XSS attack to get the authentication cookie.

In general, security isn't something that can be tacked on as an afterthought, it has to be built in from the beginning.

> WordPress has historically been a security nightmare.

This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned".

In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found."

Source(s)

http://www.darkreading.com/risk/php-security-expert-quits/d/...?

https://preilly.me/2006/11/09/php-security-expert-resigns/

PHP is the backbone of WordPress and none of the core team members have taken any of it's security holes seriously, many of which can be traced back to PHP's security hole. They simply come out with "It's the Plugin-Developer's fault" every few months when a security hole is found.

I don't think it's in their best (business) interest to fix WordPress' security holes any time soon. Because Matt Mullenweg, and other "Wordpress Security" companies like Sucuri Security, even WP Engine, all charge an arm and a length (WP Engine is 100$ a month for a simple blog serving < 25K pageviews a month) by selling "Peace of Mind" security with Wordpress if you use them / host with them.

I believe you're referring to Stefan Esser. The blog post in question can be found here[0]

  [0]https://web.archive.org/web/20061215080243/http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html

$25/mo. The $100/mo package includes up to 10 sites.

https://wpengine.com/plans/

> WordPress has historically been a security nightmare.

And the Sistine Chapel is a country church.

The bad guys of the world do nothing but find new Wordpress installs and take them over. It's a mess. I'd love to see the next year of Wordpress releases spent on nothing but fixing internal security issues and dealing with some of the upstream PHP stuff.

50% of my inbound traffic is people trying exploits.

If Django (for example) was as popular and as user-friendly as WP, there would certainly be DJEngines out there charging what WPEngine charges. It's not about security problems, it's about the fact they charge less than I (for example) can. For my clients to get from me what they get from WPEngine would easily be $1000/month, rather than $99.

One of my clients spends $99/month on WPEngine, and $5-20K per month on the advertising and social media that brings in all their new traffic. They have five people on staff, who probably cost $80-100K per month. $99 for WPEngine is a blessing--it frees them up to think about what's important, rather than wondering whether their tech provider is handling backups.

Your arguments about WP security are not strengthened by the point about WPEngine costs.

For context, here's what the dead comment says:

""" Because it's ability to generate a limitless supply of zero-days makes it easier for us in San Francisco to go after blogs we don't politically agree with.

Isn't that right, Mr. Altman. :D """

That's why wpengine is such an excellent choice for a lot of users.

On the topic of PravlageTiem, the issue of WordPress' security flaws seems to be incidental to his attempt to accuse Sam Altman of censorship. If I had to guess, that would be why the comment is dead. I wouldn't call that sarcasm.

> wpengine is such an excellent choice for a lot of users.

Here we go! Like I stated in my comment, companies like WP Engine, Sucuri and other can easily charge 100$ + for what costs < 5$ to host, because it's wordpress and they "guarantee" a secure un-hackable website.

Fear is a great motivator.

Another great motivator is that $30 or $100 is utterly trivial in the context of any website that has some actual business value and investment in its content and design. I know we're all conditioned to think web services should be nearly costless but I happily pay my WPengine bill for multiple sites every month and consider them keeping an eye on things a very good value for my fairly nominal expenditure.

Even with WPengine, security issues are a very common thing. WPengine can keep some things up to date, but plugins and themes are exploited often. Worse, an enterprise deployment at scale is a huge nightmare. Exploiting WP sites on HackerOne can be a very profitable business for many.

Not to mention, it doesn't matter if things are kept up to date when Wordpress takes months to issue a patch for critical security problems.

WordPress out-of-the-box is pretty secure, and there's a team who actively work on security, including a specific security lead. The main issues most people run into are with security of plugins and themes.

This is basically a result of plugins and themes being run as part of the main process (they're just regular PHP code), which is practically-speaking unavoidable.

That's not to say that WP is 100% impenetrable, and any large and mature software is going to have bugs, some of which may turn out to be security-related. The best defence against that is regular updates (inc. auto-updates, which are built in).

(I work at an enterprise WordPress agency where we build large sites for large clients (media orgs, banks, etc). I'm also a committer to WP core, and hence on the WP security team. I'm also one of the leads on the WP REST API project, and was running the HackerOne project until the API was merged into WP.)

Reply on news.ycombinator.com