Hacker News Reader

Comment by whatsmyusername | Hacker News Reader

Wordpress is fine if you're using wordpress.com edit: not .org (though I usually push webflow).

Hosting it yourself is a mistake. Not because it's inherently insecure (the base install isn't) but because no one can control themselves with plugins.

There's an entire cottage industry revolving around wpscan and securing/popping the millions of poorly secured wordpress instances floating around.

View on HN

We self-hosted dozens of WP sites for years. It definitely requires careful attention to keep it secure and performant. As you say, one important factor was to carefully control plugins. As an in-house team, we were able to manage these on behalf of our colleagues rather than allowing a free-for-all.

We switched our WP hosting to WP Engine a couple years ago and have been happy with that.

Surely you mean wordpress.com.

Also, millions of people host WordPress themselves and it works fine considering how much value it delivers.

It you just want to throw up a semi static site with a couple updates a year, sure. Go nuts.

The moment marketing wants to be able to login to make dynamic updates and load the instance up with plugins it's time to outsource the hosting. My team already has too much going on to spend time on this foolishness.

This got especially worse with 5.x since you can't 403 the REST API off the corporate network anymore (aka the REST API that shipped vulnerable on day 1). It's used for customer facing 'stuff' now.

We host several hundred WP sites as part of our client work... it's not super hard, but then I also have a lot of experience doing it.

There are plenty of commercial hosts at all price points that manage this stuff.

This is the real problem, Wordpress doesn't care about security. Why can a bad plugin own your entire site? Why aren't half the security options for xss protection available, let alone built in. Seems impossible to automatically add hashes for 3rd party code, not use inline css, etc

So, so many small and medium businesses online leaking the private customer information because of poorly made plugins. Nothing can shame them enough and the easiest solution is that they should stop using Wordpress plugins, and in that case it's better to use something else entirely.

Crazy opinion. Thing is that if you have such problems you maybe shouldn't use WP. Well IMHO in general I wouldn't recommend WP because of this whole mess with plugins to gain some functional enhancement. I would recommend some CMSs which have a good core functionality by default.

Reply on news.ycombinator.com