Come on guys -- it's been a while. We oversee or advise on blogs for basically every major media site (CNN, WSJ, NYT, IHT, TechCrunch, GigaOM...) as well as running WordPress myself (and WP.org) for 7+ years and have never had an application level exploit. If WP was really as insecure as you suggest, all of the news sites would look like 4chan.
It's possible to run WP in a secure manner. Just because some people don't doesn't mean you can't. It doesn't require crazy wget hacks, just updating. You can even automate it with SVN.
If anyone has questions or would like best practices for running WP in a secure manner, I'd be happy to answer them, here or over email -- m@mullenweg.com.
You should make running WordPress securely a thoughtless process. The best practices should be clearly explained to every single user who downloads/installs it.
Sure -- the simplest way to keep it secure is just keep it updated.
To this end we work with numerous third-party hosts to help them update their customers, and have invested significantly in a notification and upgrade system for 10k+ plugins, 1k+ themes, and of course the core software. This was a particular PITA because runs on so many platforms with wildly different constraints and configurations. We blog, tweet, and email 200k people whenever there's a new release and offer free help on our forums to anyone who is stuck. Someday we might even offer auto-update in core just like many hosts already do.
My comment was more aimed at the HN audience which might want pro tips for staying updated or more defense in depth. For example I have a cron job run `svn up` on my site every morning which keeps it up to date whether I'm in front of my computer or on a beach sipping mai tais.
What I suggest for most folks is to tie it to a stable branch, that way you get overnight fixes but nothing potentially backward-incompatible. When a major release comes out, you need to svn switch to the new branch.
Many folks in the WP community, including myself, svn up to trunk. I wouldn't recommend that for the general public, but I think it's only broken my site once in the past year and I fixed it by running svn up again. If I was smarter I would script it to svn up, check the site, revert if it was blank. WP.com syncs to WordPress trunk pretty regularly, as well, sometimes daily depending on where WP is in its release cycle or if we have to do any database migrations.
Has Automattic or wordpress.org published anything like the various guides found across the internet? I know you offered to email, but it would be great to see something published that is tested and comprehensive.
I've seen this page before but actually thought it to be fairly basic. What about topics such as moving wp-config.php outside of public_html, renaming the wp-admin folder, and automattic's position on some of the various 3rd-party security plugins?
One thing I don't understand, is why I can't access the admin over SSL if the Wordpress domain isn't the Apache SSL domain? For example, I can't go to https://example.com/domains/mydomain.com/wp-admin/ without getting a failed redirect. This is a major annoyance, as I can't set up another SSL site on the server without leasing another IP.
Moving wp-config.php outside of the public html folder is easy. Just do it. WordPress checks the main root level and one level above for it automatically. No configuration needed.
Renaming wp-admin is not currently possible. This is slated for future versions though.
And the reason WordPress doesn't use relative URLs is because it uses a rewrite system for most of the site. With the permalink system, most of the URLs don't actually exist as real directories, but are simply indicators to tell WordPress what sort of things you're looking for. Now, I grant you that this is not the case for the admin side of things, which uses direct links to files and the like. Those links there, however, are relative.
However, the reason the admin redirects to the right URL is because of the secure cookie handling. Cookies in WordPress are carefully controlled as to which URLs they are sent to, they're not just indiscriminately sent to the whole site. If you're using SSL Login and Admin, then the login cookies are only sent to the SSL side of things, and only to requests in the admin directories, etc. Other cookies are sent to the normal non-SSL side, which will identify you for login purposes, but not allow you administrative access. All this careful cookie handling means that the correct domain must be present for everything to work. It can't work through some other domain that it doesn't know about.
Moving wp-config.php out of public_html is mentioned on that page, section 9. I think renaming the wp-admin would probably break more than it protects.
Don't get me wrong, I love WordPress. And I can't stand Joomla. But Joomla works completely off relative URL's so it doesn't have to know it's location. The links work no matter what domain you put it on. You can access the CMS through example.com/~myusername/domains/joomladomain/ or myusername.example.com/domains/joomladomain/ or joomladomain.com/ and it will for fine every way. Which means SSL will work without a dedicated IP address. This would be awesome.
Iiiinteresting. That sounds terrible... but awesome.
I didn't know it was happening tonight. Maybe. We'll see. I've been on a roll with Hackety Hack lately, and I want to make sure I have a few hours to put in.
Whoa, someone else from Pittsburgh? I've been looking for hackers/tech culture around Pittsburgh and haven't managed to find too much so far. I think I will check this out tonight.
There are events pretty much every month, but I haven't made any in a while this will be my first Refresh Pittsburgh all year. Make sure ya say hello to this guy: http://bit.ly/9jELdY (me)
Might want to add RefreshPittsburgh, Devhouse Pittsburgh and Dorkbot Pittsburgh to the events calendar, too.
Just because there aren't as many known exploits for MT doesn't mean it's more secure than WP. That's the same argument used when people say Apple software is more secure than Microsoft software. Yet if Apple software was used by more than 90%+ of businesses, it's likely more people would attempt to (and possibly find ways to) hack it.
Security aside, MT has lots of issues -- performance (or lack thereof) being one of them and bad upgrades being another. After the third time an upgrade broke some sites I manage, I gave up and migrated some sites to WordPress and some to Drupal. Have yet to come across the same issue.
