Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated server in the future.

The site will be open for public registration like any other article directory and each registered user can manage their posts using the WP admin. The user role will be set to Author for all the registered users.

The question is that whether WP is secure enough for an article directory setup like this and whether the registered users can hack/de-stabilize the site even if all the WP security hardening is done. In a nutshell, the main concern is with the open registration.

Please advice.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Wordpress is only as secure as you make it. Open registrations should not be a problem if you:

  1. Use CAPTCHA for registrations.
  2. Use double opt-in: have users verify their email after they register. By default, registered users must be subscribers and after they are verified, you can set them as authors.

Wordpress users cannot by default hack/destabilize the installation. Your main concern would be external hackers. Use all the hardening that you can and be wary of upgrading WP.

There are many websites that trust WP for such a setup. I think http://net.tutsplus.com/ also uses WP - very effectively too. :)

share|improve this answer
    
Thanks for the reply. Currently there is no plan to use CAPTCHA during registration, but double opt-in is enabled. My main is that whether this open registration functionality will make the job of hackers easy when compared to a WP site with public registration disabled. –  Jennifer M John Jan 18 '12 at 7:04
    
If your main concern is about public registration, then I wouldn't worry about it much. A registered user is only a threat when he/she acquires the role other than what is allowed for him. To harden it much more create a separate table that contains username, password and email. A public registration happens at this table and after opt-in verification the actual WP user is created. Hence you can avoid rogue registrations and it will be transparent to the users. But the real necessity of such a strong feature is debatable. :) –  Sterex Jan 18 '12 at 12:15
add comment

A vanilla install , more or less yes, but this depends on you more than WordPress.

Take extra care with plugins and themes as they are often not sanitized based on user roles, in fact any plugins and themes should be audited for security.

Also have an approval, monitoring and back-up system in place.

share|improve this answer
    
Thanks. Will take note of your advice. –  Jennifer M John Jan 18 '12 at 8:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.