Comment by tmikaeld | Hacker News Reader

Comment by tmikaeld | Hacker News Reader

First of all, Wordpress is known to fix security issues quickly and platforms with many developers have more eyes on the code so it's only natural that they have a LOT of reported vulnerabilities. This does not mean that it's "inherently" insecure.

A static site can't enable...

- User management (Members)

- On-site-comments (That Search engines can find)

- Voting (Polls & Ratings are very popular on Wordpress!)

- Carts (For selling products)

- Any user submitted content

...without 3rd party services that rely on JS.

This means that you rely on several external services for the site to have these features and in the end, the costs will be higher than running it on Wordpress.

But it could possibly be easier to maintain, be more secure, have higher performance and the dynamic parts wouldn't all fail at the same time so the uptime of the core site could be better.

> This does not mean that it's "inherently" insecure.

It's a pretty strong indicator though.

No, the more developers the better is usually the case.

Any app that is large and complex at it's core with a very wide API that is continuously expanded on and occasionally refactored will get new bugs and vulnerabilities along the way.

Couple that with many developers that are exchanged now and then and you have a nice unavoidable mess to handle whether you want to or not.

Also, a majority of the vulnerabilities are in abandoned and badly coded plugins:

https://www.wpwhitesecurity.com/wordpress-security/statistic... (2014)

This is completely wrong. The more eyes you have on something, the more hackers attacking something combined with more pen testers and coders working on it, the more secure it is.

You know what is insecure and makes for a great target..software developed by few people, updated infrequently by people who don't care. The exact opposite of WordPress.

Not really. Sometimes you hear about the WordPress security vulnerabilities that are patched, but still exploited, and this is mostly a problem with people not keeping an eye on security updates.

Combine that with the popularity that WordPress has drawing in people who know enough to program themes and plugins, but not enough to program said themes and plugins securely (avoiding simple SQLi and XSS) and you get the perception of an insecure system that WordPress has.

Also the blame falls on actual users not keeping plugins up to date or using one's from dodgy sources.

Reply on news.ycombinator.com