Hacker News Reader

Comment by sysadm1n | Hacker News Reader

I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go through the wizard and install a new Wordpress, adding credentials, giving it a name etc. It was a lulzy thing to do but I wouldn't do it again. Back in the day you got very bored.

If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

View on HN

> If I was setting up my own Wordpress

> I would go through the wizard as quickly as possible

You might not be quicker than a bot.

I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.

I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.

Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.

Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.

because their IT group "would just slow us down"

IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.

That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.

If you're unfamiliar with the nuances of good development practices or basic security, this is an obvious thing to do. It lets you iterate and work on it until you're ready.

It doesn't even occur to a lot of people that this might be a bad idea. Salespeople, marketing, a sole prop, or someone who wants to set up a blog are all people who would have absolutely no idea how to do this right... and no clue that they're doing it wrong.

Ok sure, but these are also somehow people who are requesting and installing TLS certs?

I’m just flummoxed trying to imagine a person who can install and run certbot, but doesn’t know how to (or think to) configure locally, or even set a basic HTTP password on the site until WP is configured.

Yes, because that's the sort of thing that's easily automated and can be done for you by a setup script. Or by following a stepwise tutorial.

People don't have to understand what they're doing to use a tool. Sometimes, like this time, there can be drawbacks to this.

> If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

Do it offline, or on a private subnet, or whitelist your IP, or well anything you can to keep the world away from your install until you have it setup. Or, if possible, don't install WordPress.

Reply on news.ycombinator.com