Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Can a user spread Virus or do an harm to Multisite Installation ? Can a user take a chance of using "HTML " option in posts? In what ways do my Multi-site have chances to get attacked ?

Could you suggest me some precautions to follow with multisite ? I wanted to maintain Muilti-site for Public registrations with full features like any other Blogging platform does.

share|improve this question
add comment

3 Answers 3

Out of the box multisite has the same security as wordpress.com gives it users - being that it strips all kinds of extras, even if you are an administrator of your own blog. Super Admin has the basic WordPress permissions, everyone else does not.

no iframes, no javascript, no code.

share|improve this answer
add comment

Disclaimer - I am not experienced with multisite specifics.

This depends on amount of access user is given:

  • ability to submit/run PHP code in any form - bad, should never be allowed;
  • ability to submit unfiltered HTML (+JavaScript) - unlikely to compromise installation itself, but can be abused to post malware on frontend.

Overall this is quite specific case, which requires niche expertise. It is probably best to look for tutorials and consultations from people who specialize in such type of WP usage, rather than generic WP bunch.

share|improve this answer
add comment

if the user can install plugin or theme then my answer is yes

add:

basically there is no difference between wpmu and normal wp.

there many ways to attack a wp instance, especially when you rarely update your site. so the first tips is immediate update when an update is released.

you can harden your installation by following this steps: http://codex.wordpress.org/Hardening_WordPress

and in case you missed some steps, not allowing your users to install new theme and plugin would really help, user have a lot of power when they can upload and run php script.

share|improve this answer
    
This is not much of an answer. Can you expand upon this statement a little? –  s_ha_dum Feb 17 '13 at 18:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.