How secure is Wordpress?

Question

Hi.

Does anyone know how secure Wordpress is? I have no clue how to define "how secure". But compared to other CMS systems, how secure is it?

Update:

To elaborate a bit on my project. I'm gonna have a lot of users regitering. Once loged in, they will have access to plugins which I'm developing. In about 6 months I will also offer paid services - I'm thinking PayPal. All sensetive details will be handled on PayPals https.

Answer 1

It partially depends on your threat model. If you want to run your own blog - it's fine, just stay on top of upgrades. If you're securing patient data, no it's not secure. A lot of people bash it, but there haven't been any big security holes in WP proper for a bit, to my knowledge. It's plugins and misconfigurations.

You're going to be a target for people doing drive-by hacking, using one exploit on thousands of sites trying to drop in spam. That's why it's important to stay on top of updates. But overall, it's fine for personal, or even corporate use. I'd recommend it over trying to roll your own, for sure.

There are ways to increase it's security:

• lock down parts you don't need/use like xml-rpc
• stay on top of updates
• don't use plugins

Answer 2

I don't really know how to define how secure it is, but I can tell you a few things about it that should help you make up your mind.

By default Wordpress does not secure logins, so usernames and passwords are passed in cleartext. And most people use Wordpress like that.

That said, since version 2.6, you can force logins to be under SSL by adding this to your wp-config.php:

define('FORCE_SSL_LOGIN', true);

You can also opt for forcing SSL for all administrative tasks by using:

define('FORCE_SSL_ADMIN', true);

That should make it pretty good. And regardless of the version you are using, you can always force SSL for admin with mod_rewrite:

RewriteRule ^/wp-admin/(.*) https://myblog.com/wp-admin/$1 [C]

And, if you need a different folder for the SSL part:

RewriteRule !^/wp-admin/(.*) - [C]
RewriteRule ^/(.*) http://myblog.com/$1 [QSA,L]

That would force everything under wp-admin to work under SSL and everything else would be forced to "regular" HTTP.

Other things to consider is MySQL. If your blog communicates with MySQL over the Internet, you have one more thing to worry about. Most setups have MySQL inside a secure network, though. Even better if MySQL runs on the same machine as the web server, so you can communicate without relying on TCP/IP at all.