Ask HN: How do you manage Wordpress?

#1

Post by scollins » Mon, Apr 27, 2015, 12:30 AM UTC

Most startups I see are using wordpress for their blogs, even if their programming stack isn't based on PHP.

How do you manage wordpress security and updates if you host the blog in house? If not, what service do you use to maintain wordpress?

Re: Ask HN: How do you manage Wordpress?

#2

Post by d2xdy2 » Mon, Apr 27, 2015, 1:23 AM UTC

Not sure what I understand what you mean; I approach it much the same way that I keep up with security on my laptop. I find software (plugins) that seem reputable and update them when I get a notification to update them. If I happen to see a vuln pop up on seclist with no update from the publisher, I'll probably deactivate that plugin for a while until there's a response / update.

I think that's a fairly reasonable methodology for any web application or stack-- I run updates on most of my linux machines a few times a week, as needed, to edge out the would-be attackers (or fix other bugs I wasn't aware of).

I personally host the bulk of my stuff on a Linode VPS and just compartmentalize it into areas of duty and responsibility. My blog / portfolio gets the most attention right now from me, but stuff like my time tracking and CRM have their own areas that are "reasonably" separated from stuff like WordPress.

Re: Ask HN: How do you manage Wordpress?

#3

Post by [deleted] » Mon, Apr 27, 2015, 1:32 AM UTC

[deleted]

Re: Ask HN: How do you manage Wordpress?

#4

Post by amac » Mon, Apr 27, 2015, 1:34 AM UTC

Open an AWS account, install WP on a server and just install the updates within WP as neccessary.

Re: Ask HN: How do you manage Wordpress?

#5

Post by PebblesHD » Mon, Apr 27, 2015, 1:54 AM UTC

We run it on a secondary box in our hosted environment. It's not able to access any critical data and runs only two or three plugins that weren't written in house. Basically we keep those up to date through WordPress and patch our own stuff when issues pop up. Since it's a totally seperate environment it never really caused us any concerns about security, nor has it ever really posed a problem.

Re: Ask HN: How do you manage Wordpress?

#6

Post by emergentcypher » Mon, Apr 27, 2015, 1:59 AM UTC

We manage ours in-house, it doesn't change very often, it's mostly a matter of staying on top of security patches. But we keep it on an entirely isolated vps where it won't be able to break anything else when it gets hacked.

Re: Ask HN: How do you manage Wordpress?

#7

Post by [deleted] » Mon, Apr 27, 2015, 2:04 AM UTC

[deleted]

Re: Ask HN: How do you manage Wordpress?

#8

Post by anthony_franco » Mon, Apr 27, 2015, 2:47 AM UTC

We outsource it out to WP Engine so we don't have to worry about it.

Re: Ask HN: How do you manage Wordpress?

#9

Post by pen2l » Mon, Apr 27, 2015, 2:51 AM UTC

Wordpress is not as insecure as people think, it's only insecure when you start loading unknown plugins and such (which it seems a lot of people do do). My wordpress site has been up for about 4 years without me updating it or doing anything at all to it... and somehow it still hasn't fallen down.

Re: Ask HN: How do you manage Wordpress?

#10

Post by fsk » Mon, Apr 27, 2015, 2:55 AM UTC

1. Apply all the security updates and patches as they come out. It's literally just one click.

2. Don't to get too fancy with too much customization (writing your own plugins, weird post types).

3. Using a less mature blogging engine has its own problems. Rolling your own blog engine is nuts.

4. You can find someone to write a wordpress theme for you pretty cheaply.

5. There's a reason so many websites run on wordpress.

6. If blogging isn't your core product, there isn't much point to using something nonstandard. Would you write your own E-Mail system? Why not just use the standard blogging system?