Hacker News Reader

Comment by daveslash | Hacker News Reader

Yes.

Put the Wordpress on a completely separate server so the WordPress instance is properly firewalled from your main application/database. But don't leave it on a subdomain -- set up a reverse proxy so you can route to a subdirectory on your main domain. Better SEO. I'm not an SEO hawk, but if the point of Wordpress is marketing, then it's important.

Edit: All good replies regarding cookies. Thank you for the correction. It is not "properly firewalled". The server side code is on a different machine, but this doesn't get you "proper firewall".

View on HN

The thing is, your real app doesn’t need any SEO. just your marketing site. That’s what they need to find (and if they’re customers they go for that Login button that takes them to the app).

Marketing site on www

Real app on app.example.com or similar

Unless your real app generates pages that are indexable and optimized for search engines.

Ah, good point, I'm probably biased toward the kind of "app" which users would need to be logged into like a SaaS product, but that's not universal.

Warning, that's NOT "firewalled" from your main application/database.

If it's just part of the path on the same domain, then almost any Wordpress security vulnerability can leak over into your main application (i.e., cookies, credential stuffing, xss, etc)

Client side web attacks don't affect how the two servers are firewalled from each other. I agree it isn't properly secure, but "firewall" refers to a specific type of security.

Actually, network firewalls have nothing to do with website paths at all, but that is how the parent was using the term, so clearly they were thinking in terms of a more ambiguous term like sandboxing or isolation. Not looking to be pedantic, but by conflating the two terms, the parent was confusing both themselves and others -- and giving dangerously insecure advice.

And then a malicious/compromised plugin has access to your primary sites cookies. I think that’d be worse for SEO.

Couldn't one set the path of cookies to be for your app? Then a malicious plugin shouldn't be able to read your apps cookies, since they won't be sent to Wordpress

Most web frameworks use encrypted cookie storage by now, right? Without the server key those cookies are useless.

Not if someone takes the cookie and just passes it back to the app from their own browser to steal someone's authentication.

You can get your reverse proxy to hide /wp-admin/ from the outside world but still allow access from your trusted IPs or whatever. That will close off a few potential snags.

You might also consider a full web application firewall (WAF) - there are plenty including WP internal solutions, commercial and open source. Me? I slap HA Proxy on the front.

As you imply, I wouldn't bother fiddling with domain names - that is not a security solution and will bugger up the "message".

this is dangerous because then a rogue piece of content in your wordpress instance can exfiltrate user cookies. subdomains are much safer, if worse for SEO.

Reply on news.ycombinator.com