Comment by anakaine | Hacker News Reader

Comment by anakaine | Hacker News Reader

Parent Full thread

This comment is a load of nonsense. Wordpress core has regular and comprehensive security reviews. Wordpress is the most deployed publishing platform globally. Like with any web application you should be deploying it behind a Web application firewall with a fit for purpose ruleset, and additionally with wordpress you can integrate one of several application firewalls into the application - several of which have decent full time security and development teams that actively discover, patch and mitigate zero days and new exploits.

Anything you add beyond that is on you, and you should be vetting your vendors or own code properly.

I have to wonder what your purpose for attack here is. Are you developing a competing product?

I don't know enough to comment about WordPress. But a secure applications don't need a WAF to be secure. WAFs in the steady-state are really just fuzzy bug injectors that hope to inject bugs over top of exploitable code.

The main use for WAFs that I consider valid is emergency response to recently discovered vulnerabilities while a patch is being discovered and applied.

The other use case is external rate limiting and DoS protection. But most often it is better to do that in the app anyways.

They do plenty more than that:

- Can section off certain requests

- Can rate limit

- Can catch basic injection attacks

With the wafs that integrate with WP such as wordfence they can also do things like:

- Check for bad file permissions

- Check for bad web server configuration

- Recieve ruleset updates for zero days that are actually threat surface specific

Having a WAF in place that is threat surface specific isn't as much about saying "its not needed if the code is good" as much as it is saying "the code might not always be good. We are not perfect. I'm at least going to have an extra layer or two of defence to try and stay safe(r) and give me some breathing room between an exploit and a patch".

It's just the oft touted "WordPress is insecure" meme.

Okay, I won't argue with you. You are clearly a Wordpress Architect.

Alright, who's the funny guy? https://i.ibb.co/Xpbm1hR/funny-guy.png

Reply on news.ycombinator.com