I installed wordpress with apt, which ties in a lot of directories, so I suspect that using the built-in core update tool will break the installation; but wordfence constantly demands that I update using said tool -- which is probably much more up-to-date than the linux distro repository. Do I have to wipe it out and start over in order to resolve this annoying bind?
I actually like the idea of updating wordpress via apt, as if it is done correctly it can eliminate some headache with installing and configuring the DB and web server while followinf best practice, but the question is how reliable it is to help you maintain wordpress up to date. from looking at https://packages.ubuntu.com/groovy/wordpress it seems that ubuntu LTS is stuck with wordpress 5.3.2, so a potential problem is that you will upgrade wordpress via the wordpress admin or wp-cli and one day when you will run
apt update you will cause wordpress to actually be downgraded.
So if you go the apt way, you should probably commit yourself to keep using apt which might actually be OK in some specific settings.
As for wordfence.... with all due respect to them, wordpress setups can vary alot. I would use their "error" indications as a trigger to reevaluate what I am doing, but not as a bible.
Thanks, Mark. That was my concern. I don't really care if I have to accidentally downgrade occasionally (and temporarily), as long as it keeps working! At the moment I'm just annoyed by the constant stream of "emergency" email messages from wordfence about the core not being up to date. I tried to turn it off, but apparently they consider that update of primary importance. <sigh> I guess I'll just have to delete a lot of emails every day, unless you think it would be safe to use the built-in download updater. </sigh>– JickJul 18, 2021 at 20:20
v5.3.2 has known security vulnerabilities, upgrading to v5.3.8 would fix 16 security vulnerabilities, many of which are particularly serious, Wordfence is correct to be concerned– Tom J Nowell ♦Jul 18, 2021 at 21:11
My Pop!OS repo gave me v5.6; wordfence wants 5.7.2 instead. It also wanted me to add the Imagick plugin, which didn't work (many missing components it wanted me to install separately). I'm starting to get a bit nervous about wordfence -- it acts like an exploit!– JickJul 18, 2021 at 22:01
downgrading an application which stores anything in the DB is a non trivial thing with the main danger is that data structures had changed and the older version can not work with the new DB, therefor it is probably wise to avoid downgrades in all cost. As for wordfenece, it follows "crowd wisdom" regarding some security aspects like the need to run the latest and greatest as soon as it is out which might be a good idea if you are running a blog, but a stupid one if you have an "web app" based on wordpress. Jul 19, 2021 at 1:38
If you want to have a blog and do not understand how to keep wordpress secure by yourself you should probably just follow all it advices, so yes, if apt gives you an old version you probably should not use it and stick with the wordpress upgrade tools Jul 19, 2021 at 1:38
Do I have to wipe it out and start over in order to resolve this annoying bind?
No, since WordPress is not system level software, you can copy it, and its data elsewhere, or migrate it to a new instance installed using more standard means. You do not need to install and rebuild your site from scratch.
To get around WordFence however, you will need to update WordPress to the latest version as it wants, and do it using
apt and only
apt if you want to continue to use that tool. At the time of writing, that would be WordPress 5.7.2 with 5.8 due imminently. If you do this any method other than
apt then the changes will be undone when
apt next processes that package for an update, or a forced reinstall.
If your repository does not provide the current latest then you should contact them immediately, v5.3.2 has known security issues ( at the time of writing 5.3.8 is the newest version of the 5.3.x branch with hotfixes )
aptis highly unusual, I do not recommend using a system level package manager such as
aptto install WordPress.
composer, if you do want that advice I'd suggest a new question. WP is not system level software, and isn't built with that assumption in mind, neither are WP plugins. It's not surprising that you're running into frustrations, though it is alarming that
aptis not giving you the most recent stable version. You should report this as a major security concern to the repository maintainer.