Comments on: Is WordPress secure enough?

By: James Stein

James Stein — Mon, 08 Jun 2009 01:32:32 +0000

@Tobias – You can suggest people do not use it all you want. Fact is WordPressSecured.com offers the “ONLY” security to wordpress. It is not a plugin, it is wordpress coding changed and secured. Well over 400 customers in total are very happy with their purchase and glad that their blogs are no longer hacked.

I also go way beyond wordpress by offering an additional script that can help secure your entire site and not just wordpress.

Unless you have 15 years of coding under your belt your suggestion does not mean anything. People that listen to those that do not know what they talk about is the reason why those people get hacked.

James

By: the_guv

the_guv — Tue, 24 Feb 2009 15:05:08 +0000

Hi Pat,

I’m sorry to hear that. You know, WordPress is secure if properly secured. Of course, this isn’t a one-time thing, but the bulk of the process is, and the rest is easy to keep up.

I’ve produced a video, a 10 tips how-to, and wondered if I may link to it from here? If that’s not cool I understand, but here is a link for your perusal.

Video How-to: 10 Tips To Make WordPress Hack-Proof …
http://guvnr.com/web/blogging/10-tips-to-make-wordpress-hack-proof/

Anyhow, hope that helps someone.

Cheerio.

By: Tobias

Tobias — Sat, 10 Jan 2009 03:53:22 +0000

There’s no such thing as 100% secure software. So bailing out on WordPress is basically futile. Plus the developers do a good job of fixing security problems quick. So maybe Waite should learn how to secure his site before diving off into other software packages.

This might help: Maximum Security for WordPress – Keeps WordPress Secure

BTW: I’ve seen a copy of “WordPress Secured” sold by mass-marketer James Stein (link to his name in the previous comment listed above) and in my opinion it’s not the way to secure WordPress, plus it creates a real pain when you need to upgrade WordPress. I’d advise people to not use it – especially if you’ve already upgrade to WordPress 2.7.

By: James Stein

James Stein — Sat, 29 Nov 2008 21:38:31 +0000

Jeremy,
There are solutions that you can use that will properly protect your wordpress blog. I have helped well over 200 wordpress users secure their blogs from hackers.

Using proper solutions will cut down the chances of hacking greatly..

James

By: Jeremy

Jeremy — Tue, 28 Oct 2008 01:16:15 +0000

I keep reading all these posts about wordpress getting hacked. I am considering a wordpress site, however all these hacks I read about makes me reconsider.

I would agree though anytime you have something popular that’s what the hackers like. And I don’t believe that any script is perfect or hacker proof. Some certainly do a better job than others though.

By: Bryan Murley

Bryan Murley — Fri, 14 Mar 2008 14:10:45 +0000

It would be nice if Matt or someone would release their custom Django-based blogging platform as an open-source project. I’m sure there would be some interest in that.

I know of a couple of other sites that were hacked, probably because they were slow to upgrade (college newspaper site among them). Not sure of the solution, but most of us don’t have the mad skillz to write our own blogging app.

By: pat

pat — Wed, 12 Mar 2008 23:32:10 +0000

Amanda,

Great questions. It would be interesting to know the setup of WordPress installations that get hacked.

Certainly a Web site is a lot like a car. Any car can get hacked, but attackers tend to prefer the low-hanging fruit.

By: Amanda

Amanda — Wed, 12 Mar 2008 20:08:00 +0000

Out of curiosity since I was a linux admin in a previous life – what was his root folder permission set to?

If it was 777, a welcome doormat reading “hack me” was basically put out. Not to mention that his wp-config.php should have been set to read-only.

Unfortunately WordPress makes it easy to install without going into security details.

By: Patrick Beeson

Patrick Beeson — Wed, 12 Mar 2008 15:47:26 +0000

My current host (Dreamhost) makes it so damn simple to use WordPress — a one-click install — that it’s no wonder millions of folks use it.

I’ve used WordPress for a past version of my personal site, but switched to Movable Type because I was more familiar with the templating. I’m now running on my own blogging app in Django.

By: Matt Waite

Matt Waite — Wed, 12 Mar 2008 14:36:03 +0000

Thanks Ike for correcting me. It was 2.2 when it was hacked, and then I updated to 2.3 in response. My bad (must have had Python versions on my brain). And please understand, my reasons for rolling my own Django app are more because I can than because I want to flee WP.

By: pat

pat — Wed, 12 Mar 2008 14:13:36 +0000

I’m personally running 2.3.3. I do need to be more proactive with updating to the latest releases. I’m often a 0.0.1 behind.

This post is just a thought, because WordPress very well might be the most secure blogging platform available. There are several issues that could lead to someone’s blog going down. One I would look to would be plugins. Even if WordPress is secure, there could be issues with certain plugins.

Also, Marc brings up a good point about hosting providers. Not all hosts are created equal, and I see a lot of complaining on Twitter about hosting.

Matt, what host were you using when your database got hacked? I wonder what host MultimediaShooter.com was on as well? I’m considering getting another host if and when I launch a for-profit blog (nothing like this blog).

Obviously, WordPress is going to be a target since it is so high profile. Maybe it is just a weird coincidence that both blogs went down in a week. I don’t know, but I do know I’m sticking with WordPress for the forceable future.

Maybe we need to make a list of hosts that do secure their hardware and that are worth paying for each month?

By: Derek Willis

Derek Willis — Wed, 12 Mar 2008 12:45:29 +0000

Amen to Marc’s comments. And I’d add that this “disturbing trend” has been going on for quite some time now. Basically, if you have a web host that doesn’t secure its hardware and you don’t update your software, you’re practically inviting damage. So choose carefully, update and backup regularly, and don’t believe that any piece of software will solve all of your problems for you.

By: Ike

Ike — Wed, 12 Mar 2008 06:42:24 +0000

He was running WP 2.4 when the database got hosed?

2.4 has never been released, nor will it be. The decision was made to skip the 2.4 branch and concentrate on the 2.5 release (which was due on 3/10 but now delayed at least a week.)

I can’t argue with Matt’s logic, but jumping to the arcane as a security measure seems a little extreme, and potentially self-defeating.

By: Marc Matteo

Marc Matteo — Wed, 12 Mar 2008 05:42:53 +0000

You do have to have a little technical knowledge to run things like web servers and blogs, you know. You have to understand how to update servers and apply patches… or hope you are hosted by a vendor that does.

Yes, WordPress has had it’s security issues… but they are always addressed quickly. I daresay that PHP, the language that WordPress was written in, has had far more issues. The same goes for Linux and Apache and good Lord, IIS for a long time was a hacker whore.

Its an administrator’s roll to insure that patches are applied in a timely manor. This applies to Blogger, MovableType, WordPress, Drupal, or what the heck ever as well as the underlying OS. It’s why we make the big bucks (when compared to Journalists).

Frankly I’ve seen a number of high profile Journalism blogs — yes including JI — that have run outdated versions of WordPress for months on end. This isn’t WordPress’s fault.

The latest version of WordPress is 2.3.3, are you running it?

By: Matt Waite

Matt Waite — Tue, 11 Mar 2008 23:57:04 +0000

And I was on 2.3 when I got hacked, 2.4 when my database was chewed up.