That’s the trope. But it’s not true, provided you know what you’re doing, don’t use $50 a year hosting, don’t install a gazillion plugins, and keep stuff up to date.

Which, as I say, is the same for Every Bit Of Software Ever.

Like, consider this: your friends PC gets hacked and he loses everything. Turns out they were running ‘doze 95 and had failed to update or backup. Where is your sympathy? Right, you’re thinking “you’re a fool!”. And you’re right. They failed to look after their stuff, and it created a problem.

Why is this any different with WordPress?

Do it well, and the “security for Wordpress is pretty bad” trope just goes away.

> it’s not true, provided you know what you’re doing, don’t use $50 a year hosting, don’t install a gazillion plugins, and keep stuff up to date.

But... we started this thread with 'WordPress isn't for you, the alternative isn't a static site and a CI pipeline', so it's supposed to be for people who don't know what they're doing, often do use $50 a year hosting that comes with 'cPanel', keep installing different plugins until one kind of does what they want and then leave all the others, and never update anything until something breaks/they want something new and they start installing plugins again.

Why? It has auto updates for a long while now. Honestly, I've received auto update notification by emails more often before I see any blog posts or news article about the vulnerability itself. I agree it used to be worse, but this? This is awesome.

I think your comment just proved the OP's point.

I've had customers using WP in the past, and defacement was just part of the routine. It's an annoyance for the business owner for sure, but so are personnel issues, finance, legislation changes, etc.

For most businesses, there are more important issues than having a perfectly optimised and hardened website.

WP, as bad as it is, is 'good enough' for most websites.