-3

One of my friend who is RIA developer and do action scripting. He started a blog and worked on it, after some time he saw that his blog is hacked that was developed in WP and some text was written in it so he just went to FTP and deleted all files.

So all this seems that a WP sites probability for being hacked is more than site built in RoR or Django or CakePHP or kohana e.tc. Is it true? What was actually the reason of hacking? Is there really some security vulnerabilities in WP?

I am a PHP developer and also have developed many custom sites, and also have worked in WP and joomla e.t.c. but never heard any thing like that. If it is problem there then can SSL solve this problem? Confused that how that happened...

Please tell me if you have any idea so that I can understand it and get out of curiosity.

5
  • 3
    "So all this seems that a WP sites probability for being hacked is more than site built in RoR or Django or CakePHP or kohana e.tc" There's no valid such logical deduction here whatsoever. You saw a WP site being hacked, once, and have decided based on that alone that WP is less secure than some other arbitrary packages. How come? Oct 21, 2011 at 19:42
  • Anyway, this is not a real question. It's either too broad ("explain to me everything about web security please") or too vague ("my site was hacked once; what happened?")... and probably both. Oct 21, 2011 at 19:43
  • 2
    He probably didn't keep up on WordPress security patches.
    – ceejayoz
    Oct 21, 2011 at 19:48
  • @Tomalak Geret'kal: I didn't make any decision but many of my friends told me that WP is a less secure thing that's why I am here to ask that why many people think like this? Only because every one know that how security of WP works? If yes then same is the case with Django? It also have its own authentication and people know about this? So is there some thing really original about this saying about WP or nothing like that? If yes then can I avoid that?
    – Hafiz
    Oct 21, 2011 at 19:59
  • Following is what that I wanted to ask and don't be emotional about WP, it was just a question that why many people think that and how much truth is in it, and what I have understand is that it was may be due to less update of WP or may be the this was because of third party plugins. And also how Wayne told about SSL. Thanks for reviewing my question.
    – Hafiz
    Oct 21, 2011 at 20:12

2 Answers 2

3

Wordpress is moderately secure, but I just had two of my WP blogs hacked last week and had to rebuild. In the process I learned some helpful hints. Some of these hints are general for all sites, some specific to WP.

  1. Always upgrade to the most current stable version of WP. Older versions may have known exploits.
  2. There are several things you can do manually to secure your WP site, but instead use one or more of the established security plugins. Right now I am using both PBS (Bullet Proof Security) and WPD (Website Defender). Follow the guidance from these plugins; take some time to learn them well.
  3. Run Akismet (or similar) to minimize rogue spam posts.
  4. Turn off remote posting (ATOM and XML-RPC) unless you require it for your business model.
  5. Harden your admin PW (and don't call your admin account ADMIN).
  6. Don't install lots of experimental plugins onto your site to try them out. Create a sandbox site for this. Keep the installed plugins on your live site to a minimum.

Hope this helps.

1
  • thanks Danny , we will remember these things and will also tell to others
    – Hafiz
    Oct 21, 2011 at 21:48
2

Wordpress is a relatively secure product. However as with anything nothing is 100% fool-proof. Unfortunately with widely-used products such as Wordpress once an exploit is found it is widely available on 0-day exploit sites and a lot of hackers will trawl the web to take advantage of this exploit.

However staff at Wordpress are very quick to patch these errors which is a plus. Also the installation of plugins coded by the non Wordpress team can be open to exploits and is the most common way a hacker finds his way in. If there is an issue an SSL certificate will not stop the site being hacked. Will just mean that an form data will be passed between locations with better encryption. I hope this helps.

3
  • oh yes, this is all what I was asking about
    – Hafiz
    Oct 21, 2011 at 20:00
  • thanks Wayne, thanks a lot for once reading the question carefully and giving precise answer, and I am satisfied with what you said.
    – Hafiz
    Oct 21, 2011 at 20:02
  • -1 wordpress secure? I don't think you should be spreading such information. The developers on this project do not understand even the most basic principles of secuirty.
    – rook
    Oct 21, 2011 at 20:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.