Comment by sean_patel | Hacker News Reader

Comment by sean_patel | Hacker News Reader

Parent Full thread

> WordPress has historically been a security nightmare.

This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned".

In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found."

Source(s)

http://www.darkreading.com/risk/php-security-expert-quits/d/...?

https://preilly.me/2006/11/09/php-security-expert-resigns/

PHP is the backbone of WordPress and none of the core team members have taken any of it's security holes seriously, many of which can be traced back to PHP's security hole. They simply come out with "It's the Plugin-Developer's fault" every few months when a security hole is found.

I don't think it's in their best (business) interest to fix WordPress' security holes any time soon. Because Matt Mullenweg, and other "Wordpress Security" companies like Sucuri Security, even WP Engine, all charge an arm and a length (WP Engine is 100$ a month for a simple blog serving < 25K pageviews a month) by selling "Peace of Mind" security with Wordpress if you use them / host with them.

I believe you're referring to Stefan Esser. The blog post in question can be found here[0]

  [0]https://web.archive.org/web/20061215080243/http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html

> WordPress has historically been a security nightmare.

And the Sistine Chapel is a country church.

The bad guys of the world do nothing but find new Wordpress installs and take them over. It's a mess. I'd love to see the next year of Wordpress releases spent on nothing but fixing internal security issues and dealing with some of the upstream PHP stuff.

50% of my inbound traffic is people trying exploits.

If Django (for example) was as popular and as user-friendly as WP, there would certainly be DJEngines out there charging what WPEngine charges. It's not about security problems, it's about the fact they charge less than I (for example) can. For my clients to get from me what they get from WPEngine would easily be $1000/month, rather than $99.

One of my clients spends $99/month on WPEngine, and $5-20K per month on the advertising and social media that brings in all their new traffic. They have five people on staff, who probably cost $80-100K per month. $99 for WPEngine is a blessing--it frees them up to think about what's important, rather than wondering whether their tech provider is handling backups.

Your arguments about WP security are not strengthened by the point about WPEngine costs.

$25/mo. The $100/mo package includes up to 10 sites.

https://wpengine.com/plans/

Reply on news.ycombinator.com