Re:Disclosure of Additional Security Fix in WordPress 4.7.2
by davidgerard on Thursday February 02, 2017 @10:39AM
(#13551234)
Wherever possible, outsource. wordpress.com if you can deal with their limited selection of themes and plugins, any number of third-party outsourcers whose bread and butter is WordPress if you need your own theming.
(I maintain three WP myself by hand, but that's me being a control addict.)
WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.)
A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)
(I maintain three WP myself by hand, but that's me being a control addict.)
WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.)
A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)