0

One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated server in the future.

The site will be open for public registration like any other article directory and each registered user can manage their posts using the WP admin. The user role will be set to Author for all the registered users.

The question is that whether WP is secure enough for an article directory setup like this and whether the registered users can hack/de-stabilize the site even if all the WP security hardening is done. In a nutshell, the main concern is with the open registration.

Please advice.

Improve this question

2 Answers 2

Reset to default
0

Wordpress is only as secure as you make it. Open registrations should not be a problem if you:

  1. Use CAPTCHA for registrations.
  2. Use double opt-in: have users verify their email after they register. By default, registered users must be subscribers and after they are verified, you can set them as authors.

Wordpress users cannot by default hack/destabilize the installation. Your main concern would be external hackers. Use all the hardening that you can and be wary of upgrading WP.

There are many websites that trust WP for such a setup. I think http://net.tutsplus.com/ also uses WP - very effectively too. :)

Improve this answer
2
  • Thanks for the reply. Currently there is no plan to use CAPTCHA during registration, but double opt-in is enabled. My main is that whether this open registration functionality will make the job of hackers easy when compared to a WP site with public registration disabled.
    – Jennifer M John
    Jan 18, 2012 at 7:04
  • If your main concern is about public registration, then I wouldn't worry about it much. A registered user is only a threat when he/she acquires the role other than what is allowed for him. To harden it much more create a separate table that contains username, password and email. A public registration happens at this table and after opt-in verification the actual WP user is created. Hence you can avoid rogue registrations and it will be transparent to the users. But the real necessity of such a strong feature is debatable. :)
    – Sterex
    Jan 18, 2012 at 12:15
1

A vanilla install , more or less yes, but this depends on you more than WordPress.

Take extra care with plugins and themes as they are often not sanitized based on user roles, in fact any plugins and themes should be audited for security.

Also have an approval, monitoring and back-up system in place.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.