Re:“Drupalgeddon2” touches off arms race to mass-exploit pow...
by snowwrestler on Sunday April 22, 2018 @01:37PM
(#16897308)
Most CMS security is basic stuff like file permissions (where Wordpress sites often get into trouble), applying community patches quickly (both Drupalgeddons), and managing JS library dependencies (a notable hole in the Drupal patching ecosystem).
It takes some expertise to do these correctly, but it's not rocket science. I taught myself and have self-hosted Wordpress and Drupal sites for 8+ years with very few security incidents.
That said, I'm moving my Wordpress and Drupal sites to platforms like WP Engine and Pantheon. But not because of security concerns--because the platforms will accelerate our development process by making it easier for developers to create staging instances and deploy to production.
It takes some expertise to do these correctly, but it's not rocket science. I taught myself and have self-hosted Wordpress and Drupal sites for 8+ years with very few security incidents.
That said, I'm moving my Wordpress and Drupal sites to platforms like WP Engine and Pantheon. But not because of security concerns--because the platforms will accelerate our development process by making it easier for developers to create staging instances and deploy to production.