3

I am going to start a big corporate website for his car shop which is supposed be more secured. Is Wordpress okay to start a secured and reliable website?

As far as i heard, Wordpress hackers intrude to webservers by means of some vulnerable plugins. Is that true?

What If I build a website without even a single plugin? Would Wordpress be secured then?

  • This might help – Und3rTow Jun 25 '15 at 6:01
  • You can create your website and then install the plugin "iThemes Security". It provide many poowerful features – Sirina Jun 25 '15 at 12:43
  • Del comment. :P – Sundar Jul 13 '15 at 8:45
7

In a general sense, any well maintained platform can be used to to create a website with good security. It has to be noted that you will never build a website which is completely secured against hacking and spamming, no matter which platform you use and no matter what genius or pro you are. Hackers evolve faster that the security of a specific piece of code targeted to keep them out.

Wordpress core itself is quite safe with good security. The big plus is that core is well maintained and kept up to date, so the security risks are kept to a minimum. The only downside is that core is still made compatible with PHP 5.2.something, which has been EOL'ed years ago. PHP 5.3 was EOL'ed almost a year ago.

That all aside, it does not matter how secure the platform is which you are using, it is all about the custom code you are going to use. It is a fact, there are thousands of really poor written themes and plugins out there which I would not even install on my local test installation, I might get hacked off line through these plugins and themes, hahaha ;-). Back to being serious, you need to make sure that all custom code is secured. Never ever take any input for granted and never ever trust any type of input (specially values coming from the URL or info coming from a text input field), and never execute php in text fields. VALIDATE ESCAPE SANITIZE, remembr these terms. Treat all data on merit and use the proper methods according to the data to escape, validate and sanitze the data to make it safe. User input data is most the easiest way to inject data in to your site by hackers. A simple one line of javascript entered into the URL or a text field can give a hacker full access to your site to inject custom code.

One very important note, keep your site and code up to date. Use proper well known hosting companies. Poor quality hosts rarely support PHP versions newer than PHP 5.4. As I said, PHP 5.3 was EOL'ed almost a year ago, so it is not maintained anymore, which in turn means big security issues if you are still using it. Get a host which support atleast PHP 5.4 which is still currently maintained. Proper hosts also have extra features for added security.

Upgrade Wordpress when there are an update available. Try to have the latest version installed. There are also very well known good security plugins available and captcha validation plugins for forms.

Lastly, if you haven't done so yet, get yourself a proper off line testing local install where you can test code, plugins and themes. Go through the code and make sure of the integtity there of. Only add code, plugins or themes to your live site if you are happy with it after proper off line testing

This should be a minimum guide to help you

3

Nothing is 100% secure, so plan for the worst:

Assume that your site will be hacked one beautiful day and even totally deleted.

Consider therefore recovery plans with:

  • offsite backups for your database and uploaded files,
  • offsite version control repositories for your code (themes and plugins).

Decrease the risk by using:

  • up-to-date "trusted" software,
  • secure connections,
  • strong passwords.

... and hope for the best ;-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.