41–50 of 90 posts
Earlier quoted context omitted.
This is exactly the reason why I'm building Pragma (it's a static site builder with client focused UX) http://www.laktek.com/2016/11/29/introducing-pragma/
Awesome. Signed up for the beta.
I love wordpress, but I don't love PHP, updates, security flaws, or hosting. I haven't done it yet, but I'm considering using the Simply Static plugin[0] to migrate to generated static pages from my wordpress instance, which sidesteps all of those problems. [0]: https://wordpress.org/plugins/simply-static/
I would also look into the myriad of static site generators that are probably much faster than the WP static site plugin and use modern tools and libraries. https://www.netlify.com/blog/2016/05/02/top-ten-static-websi... Roots is mentioned, but the team has since developed Spike which is built on a more modern stack: https://github.com/static-dev/spike https://www.spike.cf/
Wordpress could solve a lot of security issues by using a newer version of PHP, but they are scared of breaking legacy items. Also using things like Wordfence and Cloudflare solve most of the basic Wordpress security issues.
I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPre…
> WordPress has historically been a security nightmare. This. And all this started around the same time - in 2006 -- when Stefan Esse, the PHP security expert "resigned". In a blog post in 2006 (that can no longer be found) Esse was quoted as saying he quit > "because among other things they were resistant to his finding bugs in PHP, and had refused to patch some of the bugs he found." Source(s) http://www.darkreadin…
And the Sistine Chapel is a country church.
The bad guys of the world do nothing but find new Wordpress installs and take them over. It's a mess. I'd love to see the next year of Wordpress releases spent on nothing but fixing internal security issues and dealing with some of the upstream PHP stuff.
50% of my inbound traffic is people trying exploits.
Because people who don't actually know how to build websites are fooled into thinking they have a tool that will fill that knowledge gap, despite the security implications that they are oblivious to.
It's the first choice among a huge number of web devs though, which seems contrary to it being that the person deploying it doesn't know better.
One of the great things about WordPress is the plugin ecosystem. This is also a something of an achilles heel, especially when it comes to security. WordPress seems to attract a lot of lowest-common-denominator coders who create plugins. So while the WordPress core is now pretty solid when it comes to security, the various plugins are almost never coded to the same standard. I have to wonder if WordPress added a smal…
An alternative would be for plugin authors to achieve a Core Infrastructure Initiative Best Practices Badge, which is free and shows a commitment to secure coding. https://bestpractices.coreinfrastructure.org Disclosure: I'm the co-author of the badge at the Linux Foundation.
The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds)
Having an audited plugin repository for Wordpress is an idea i've had in the back of my mind for a while now. I believe it's something a lot of businesses would pay for
I really like Wordpress, it gets a lot of hate; but it's easy to develop on allowing for fast turn around, has the best editor of any CMS around for client happiness, and has a robust ecosystem. I'm in charge of around ~150 websites that run Wordpress, and I moved them all under an active management platform with always up to date plugins, themes and core. I inherited a lot of them with my new job, but I am slowly putting them all behind Cloudflare's firewall and setting up the appropriate page rules to keep them safe. I often scan them and compare them against the core to make sure there have been no changing of core files by a hack. I also have them on scheduled back-ups to private Azure blobs and have alerts set up with Azure's monitoring tools.
It takes a while to set all of that up, but once it is set up your install is pretty safe against any sort of attack relative to other CMSs. Another great thing about WP is if it IS hacked, it's pretty easy to fix. Other CMSs getting hacked is quite the chore to hunt down, especially the other major PHP based CMSs. I'm looking at your Magento & Drupal.
I think about what is best for turn around, has the best cost/benefit, and what makes clients happiest, and so far that is Wordpress is the answer 90% of the time. Until that changes, Wordpress will continue to run a huge chunk of the web. I do grant you that a lot of lazy developers and unmanaged/out-of-date installs from agencies, small businesses and individuals are hacked very often and are often turned into zombie sites. There's no doubt about that. But just taking some basic common sense security measures can do wonders and keep you and your clients safe(r) from attack.
I'm looking at the "dead" comment by PravlageTiem. I understand that PravlageTiem was being sarcastic, and some people feel that sarcasm undermines the tone that is supposed to prevail on Hacker News. But still, PravlageTiem raises an important point: WordPress has historically been a security nightmare. Possibly there was a tone of anger in the way PravlageTiem expressed themselves, but the security flaws in WordPre…
Yeah, I wish I could recommend WordPress to people because it's really nice at what it does, but the security flaws are too serious.The fact that it takes months for them to fix serious vulns reported to them only makes it worse. Seriously, there are youtube tutorials about 'How to Hack Wordpress.' It can't get much worse than that: https://www.youtube.com/results?q=wordpress+hack
Earlier quoted context omitted.
An alternative would be for plugin authors to achieve a Core Infrastructure Initiative Best Practices Badge, which is free and shows a commitment to secure coding. https://bestpractices.coreinfrastructure.org Disclosure: I'm the co-author of the badge at the Linux Foundation.
Is there a single plugin that has been granted the badge? The policy docs don't seem specific enough in areas where plugin developers need help (ie. don't use superglobals, raw sql or PHP scripts outside of the plugin load process) while being an over burden in less important areas (ie. requirement that each project have a security expert, and CI builds) Having an audited plugin repository for Wordpress is an idea i'…
I agree that a big part of wpengine's value is the validation they do of certain plugins. A business model that could charge for information of which plugins are most safe would be challenging.
The goal of the Badge project is to incentivize improved behavior by the plugin authors.
I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…
I see WP Engine touted as a solution. My limited experience with a client several months ago was "hey, we're getting really big, we need better security and better performance", they shop around, and get sold (in a literal sense) on WP Engine. Signed up, and my friend started to try to migrate things over. Oh... yeah, they don't actually support many custom plugins - you could select from some blessed ones, but the c…
I took over supporting/developing a WordPress site and one of the first things I did was delete a bunch of pointless plugins. I wound up writing quite a few of my own for different tools and left some third party plugins so there are still probably 10 active between 3 sites on a multisite install.
I installed Google analytics directly in the header of the custom themes on each of the multisites.
There were no comments so all of the comment plugins were pointless, as were all the form plugins except for one.
So, why so many plugins? Am I missing something?