0

I installed wordpress with apt, which ties in a lot of directories, so I suspect that using the built-in core update tool will break the installation; but wordfence constantly demands that I update using said tool -- which is probably much more up-to-date than the linux distro repository. Do I have to wipe it out and start over in order to resolve this annoying bind?

Improve this question
4
  • 1
    Installing WordPress via apt is highly unusual, I do not recommend using a system level package manager such as apt to install WordPress.
    – Tom J Nowell ♦
    Jul 17, 2021 at 1:12
  • Well, most Linux sysops seem to believe that installing software directly off the Internet should be highly unusual, and generally unwise. That (and convenience) is the whole point of maintaining repositories. Now, you may insist that "WordPress is different!" -- as do all proponents of off-repository packages -- and/or that Pop!OS & Ubuntu repositories are suspect. While I can't confirm or deny that, in the end you have to trust someone, and I've decided to trust the people that millions of other users have chosen to trust.
    – Jick
    Jul 18, 2021 at 20:14
  • In any case, I've already spent a week or two getting my wordpress site working again, so I'm not looking for advice on how to start over from scratch.
    – Jick
    Jul 18, 2021 at 20:14
  • And I'm not providing advice on how to start over again, though it would take much less than a week to switch to a standard WP install, or one managed by a more appropriate package manager such as composer, if you do want that advice I'd suggest a new question. WP is not system level software, and isn't built with that assumption in mind, neither are WP plugins. It's not surprising that you're running into frustrations, though it is alarming that apt is not giving you the most recent stable version. You should report this as a major security concern to the repository maintainer.
    – Tom J Nowell ♦
    Jul 18, 2021 at 21:01

2 Answers 2

Reset to default
0

I actually like the idea of updating wordpress via apt, as if it is done correctly it can eliminate some headache with installing and configuring the DB and web server while followinf best practice, but the question is how reliable it is to help you maintain wordpress up to date. from looking at https://packages.ubuntu.com/groovy/wordpress it seems that ubuntu LTS is stuck with wordpress 5.3.2, so a potential problem is that you will upgrade wordpress via the wordpress admin or wp-cli and one day when you will run apt update you will cause wordpress to actually be downgraded.

So if you go the apt way, you should probably commit yourself to keep using apt which might actually be OK in some specific settings.

As for wordfence.... with all due respect to them, wordpress setups can vary alot. I would use their "error" indications as a trigger to reevaluate what I am doing, but not as a bible.

Improve this answer
6
  • Thanks, Mark. That was my concern. I don't really care if I have to accidentally downgrade occasionally (and temporarily), as long as it keeps working! At the moment I'm just annoyed by the constant stream of "emergency" email messages from wordfence about the core not being up to date. I tried to turn it off, but apparently they consider that update of primary importance. <sigh> I guess I'll just have to delete a lot of emails every day, unless you think it would be safe to use the built-in download updater. </sigh>
    – Jick
    Jul 18, 2021 at 20:20
  • v5.3.2 has known security vulnerabilities, upgrading to v5.3.8 would fix 16 security vulnerabilities, many of which are particularly serious, Wordfence is correct to be concerned
    – Tom J Nowell ♦
    Jul 18, 2021 at 21:11
  • My Pop!OS repo gave me v5.6; wordfence wants 5.7.2 instead. It also wanted me to add the Imagick plugin, which didn't work (many missing components it wanted me to install separately). I'm starting to get a bit nervous about wordfence -- it acts like an exploit!
    – Jick
    Jul 18, 2021 at 22:01
  • downgrading an application which stores anything in the DB is a non trivial thing with the main danger is that data structures had changed and the older version can not work with the new DB, therefor it is probably wise to avoid downgrades in all cost. As for wordfenece, it follows "crowd wisdom" regarding some security aspects like the need to run the latest and greatest as soon as it is out which might be a good idea if you are running a blog, but a stupid one if you have an "web app" based on wordpress.
    – Mark Kaplun
    Jul 19, 2021 at 1:38
  • If you want to have a blog and do not understand how to keep wordpress secure by yourself you should probably just follow all it advices, so yes, if apt gives you an old version you probably should not use it and stick with the wordpress upgrade tools
    – Mark Kaplun
    Jul 19, 2021 at 1:38
0

Do I have to wipe it out and start over in order to resolve this annoying bind?

No, since WordPress is not system level software, you can copy it, and its data elsewhere, or migrate it to a new instance installed using more standard means. You do not need to install and rebuild your site from scratch.

To get around WordFence however, you will need to update WordPress to the latest version as it wants, and do it using apt and only apt if you want to continue to use that tool. At the time of writing, that would be WordPress 5.7.2 with 5.8 due imminently. If you do this any method other than apt then the changes will be undone when apt next processes that package for an update, or a forced reinstall.

If your repository does not provide the current latest then you should contact them immediately, v5.3.2 has known security issues ( at the time of writing 5.3.8 is the newest version of the 5.3.x branch with hotfixes )

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.