Everyone else: if you can avoid it, don't run Wordpress. You can run a safe Wordpress site, but you do it the same way you drive fast without a seatbelt: by playing the odds.
Build a custom CMS for your website, on the basis that even though you probably won't do a better job than wordpress in terms of security you will be obscure enough that nobody will bother you?
I've actually done this in the past with no (known) compromises on something that I'm sure I could pay a smart teenager who watched a few defcon talks to rip apart in an few hours.
Or is there some platform you would recommend that is inherently more secure by design? Like an OpenBSD of the CMS world.
Use a static site generator to the extent that you can. But, honestly: I think you'd stand a good chance of doing better than Wordpress starting from scratch. There are a couple of very difficult design decisions embedded into Wordpress that make life much harder for them than it needs to be for you.
For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).
For another, an integrated comment system that stores credentials for anonymous Internet users in the same data structure as the one used for site administrators.
Comments
If you say so.
Everyone else: if you can avoid it, don't run Wordpress. You can run a safe Wordpress site, but you do it the same way you drive fast without a seatbelt: by playing the odds.
What do you recommend instead?
Build a custom CMS for your website, on the basis that even though you probably won't do a better job than wordpress in terms of security you will be obscure enough that nobody will bother you?
I've actually done this in the past with no (known) compromises on something that I'm sure I could pay a smart teenager who watched a few defcon talks to rip apart in an few hours.
Or is there some platform you would recommend that is inherently more secure by design? Like an OpenBSD of the CMS world.
Use a static site generator to the extent that you can. But, honestly: I think you'd stand a good chance of doing better than Wordpress starting from scratch. There are a couple of very difficult design decisions embedded into Wordpress that make life much harder for them than it needs to be for you.
What are those "very difficult design decisions embedded into WordPress that make life much harder for them than it needs to be for you" prey tell?
For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).
For another, an integrated comment system that stores credentials for anonymous Internet users in the same data structure as the one used for site administrators.