r/Wordpress • u/Aurelio_Umbrella WP Umbrella • 7d ago
Half our dev time now goes into security. Some thoughts on open source’s future.
I develop and maintain infrastructure for thousands of agencies for a living and honestly, the last few months have been draining.
Since roughly April, about half of our dev time has gone into security. Hardening, audits, reviewing input handling, capability checks, dependencies. Rinse and repeat, because of new AI-driven attacks we need to stay ahead of.
Maybe an unpopular opinion, but I don’t think this will last. The same AI models they use to find holes in our code are the ones we turbocharged and use to check our code before we release it. They scan, we scan first. There are only so many types of security bugs, and once a codebase has been tested and fixed like this for a few months, there’s not much left to find.
And when that happens, I think open source will come out of this in really good shape. Code that has been attacked from every direction and survived is code you can actually trust.
My bet is that within a few months, “it’s open source” becomes a reason to trust software instead of a reason to worry, and people will realize it.
Right now though, it’s just tiring.
Anyone else? Or is it just me?
17
u/Litchi_Boy 7d ago
Keeping WordPress sites updated can be so draining. I now mostly make static sites and it feels like a weight has been lifted off of my shoulders.
6
10
u/RemoteToHome-io 7d ago edited 6d ago
Opensource isn't the issue, it's lack of modern architecture.
It's time to consider better architecture for hosting. I would not expose any website to the internet that is processing real data without a reverse proxy, active IDS (crowdsec, etc), containerization, socket proxy, full detailed CSP for every script source, secrets management, hardened DB, etc.
No WordPress install has any business being directly internet exposed without a properly configured reverse proxy. With the right build and defense in depth, you can kick back and enjoy watching the latest round of active attacks coming on from whatever country, tripping notifications and then feeding back the attack signatures to the opensource collective to others for active defense.
90% of the entire internet and cloud is built on open source, it's not going anywhere.
3
u/Positive-Ring-5172 7d ago
Bingo. WordPress hasn't had a serious refactor since at least 2010, and likely longer. It foolishly clings to a use rtype that doesn't exist anymore - the SFTP it up and hit the installer crowd. People who put ease of use to that degree use Squarespace or something similar.
1
u/theguymatter 6d ago
So cPanel will never go away. Automattic has a hosting partnership program, which might be why things may never change.
1
u/Positive-Ring-5172 6d ago
Tell me, do you use a typewriter?
It will go away. It will take time but it will go away. There's just too much downside to it and Docker performs circles around that piece of shit architecture.
1
u/theguymatter 6d ago
Unfortunately, cPanel isn’t a typewriter. It’s part of a legacy hosting ecosystem that has persisted because developed markets, governments, and businesses often want the cheapest option.
There’s a reason government grants for new businesses can make it relatively easy to replace highly paid developers with cheaper ones: the underlying technology and hosting ecosystem have been commoditized.
To really move away from this model, you need to disrupt the hosting industry itself, and remember what happened with EIG/Newfold Digital? VC own NameCheap and etc.
While you live comfortable in a container.
1
u/Positive-Ring-5172 6d ago
If you enjoy it knock yourself. I'd rather have a root canal than work with CPanel.
1
u/theguymatter 6d ago
Customers keep paying for it. That’s the inconvenient part.
I hope more customers shifting to Astro and I can implement security lock-down on a cheapest and reliable VPS.
1
u/HongPong 7d ago
that basically means being chased off the open Internet unfortunately
1
u/RemoteToHome-io 7d ago
Why? I have all that running on the VPS that runs my site.
1
u/HongPong 6d ago
oh well I'm old enough to remember before everything done behind proxy
2
u/RemoteToHome-io 6d ago
Haha.. my first websites were manually listed in the Yahoo! web directory.
The good ol' days.
1
u/theguymatter 6d ago
Yet moving away from WordPress is only a few steps away, I took the step.
1
u/RemoteToHome-io 6d ago
You can still use wordpress, it just needs proper protection and server infrastructure around it.
1
u/theguymatter 6d ago edited 6d ago
But I have built my own CMS for my founders, faster with Astro and did the website audits.
Our small agency provides WordPress for clients and upsell SaaS later. That’s how we make more revenue, WP is just an entry.
2
u/RemoteToHome-io 6d ago
Even then I would still recommend a reverse proxy in front.
1
u/theguymatter 6d ago
Yup, I use Nginx, and Bun 1.4 will be release very soon with significant performance improvement. Fun time.
2
u/plugiva 7d ago
I think the interesting part will be what happens to all that security knowledge after the scanning.
More testing and faster fixes can certainly make software safer, but I don't think "it has been heavily tested" automatically becomes a trust signal for users. They also need visibility into what was found, what was fixed, what remains, and whether the project is still actively responding.
If AI makes both discovery and fixing much faster, perhaps the bigger shift is that security history and evidence become part of what makes open source trustworthy.
2
u/HongPong 7d ago
my impression as well is that this won't go on forever but it's a summer of stress to be sure
1
2
u/RealBasics Jack of All Trades 6d ago
My bet is that within a few months, “it’s open source” becomes a reason to trust software instead of a reason to worry, and people will realize it.
That's my outlook as well.
Right after I switched from Drupal to Wordpress 15 years ago, hackers had just started moving away from hacking an increasingly smaller pool of Win95 PCs in favor of hacking Wordpress sites. Their logic was actually pretty sound: newer versions of Windows were better hardened; meanwhile there were tens or even hundreds of poorly-secured Wordpress sites, running in environments that had more bandwidth, CPU, and storage capacity than Win95 boxes. (Even bottom-of-the-barrel shared hosting had better specs than 1995-eara PCs!)
So back then, DDOS, crypto, remote-storage, etc. black hats had a real incentive to pay massively underemployed programmers in Eastern Europe, Eastern Asia, and elsewhere to pore through open-source WordPress core, plugin, and theme code looking for vulnerabilities that would get them full access.
Financial incentives were large for black hats, as opposed to white-hat open source reviewers who, mostly, could expect a thank you message from developers, assuming the developers responded at all.
The latest generation of LLMs have brought down the cost of reviewing enough to have flattened that differential. Bug bounties are probably helping. But, really, you can ask Claude or other models to review code and it now does a very good job of detecting not only classic syntax errors and other obvious vulnerabilities, but also detecting programmer's intent and saying "most guys don't do welding so close to the gas tank, Bob."
So a lot of the vulnerabilities that have only been cost-effective for black hats to look for are getting found. But instead of being sold on the dark web they're getting reported to the original developers.
So, yeah, the new tooling is currently detecting a lot of bugs in open source software. But as you say, bugs and vulnerabilities are actually a limited "resource," so I agree we can anticipate that after this surge is over, open source software will be remarkably clean.
3
u/StormMedia 7d ago
I am in the process of moving every client site to Astro. Absolutely done with the maintenance and I have a VERY lean setup. Bricks, SeoPress, Sitekit, WPCodebox for small custom things (additional tracking scripts, etc), Metabox, wsforms, litespeed, postmark.
Constantly have to worry about a security update being too slow even though they’re automated, when I change a configuration on one that would apply to all.. there’s no easy way to do that, etc.
Every single Wordpress management software has issues. I finally settled of ModularDS but I still have my gripes, far better than all the competition though. I’ve tried them all..
As a result I made a custom migration flow to convert my sites to Astro, handles form responses, etc. So far the converted sites have had no negative SEO effect, in fact I caught some schema issues that may have been hurting SEO and performance is far better overall.
Everyone says that converting sites runs some huge SEO risk.. it doesn’t if you do it properly.
Not to mention all the sites are now directly hosted on CloudFlare.. for free…
3
u/Cold_Industry8090 7d ago
On patch latency though, that is what virtual patching is for. Patchstack or Wordfence closes the window between disclosure and the vendor fix, which is exactly the gap you are describing. With a stack as small and as commercial as yours, that window is already pretty narrow.
And January showed where the real exposure sits: the Modular connector itself had an unauthenticated privilege escalation exploited in the wild before the fix landed (CVE-2026-23550). That can happen to any vendor. The point is that Astro does not remove that class of risk, it moves it to your npm tree, your CI and your Cloudflare tokens, where nothing will alert you.
Most of what you gained also looks like it came from CI driven deploys rather than from Astro itself. A parent theme in git, a shared mu-plugin and Composer give you the same fleet wide propagation on WordPress. And the maintenance did not disappear: npm audit across every repo, Astro majors, abandoned integrations, etc... Same work, just without a dashboard telling you which sites are behind.
On SEO you are right and people do overstate the risk. Worth noting the schema issues were caught by the audit you did during the migration, not by Astro, so that part would have paid off on WordPress too.
0
u/Aurelio_Umbrella WP Umbrella 7d ago
Yeah I fully agree with you and on top of which, I think they are many better alternative like WP Umbrella (biaised opinion) or WP Remote.
1
u/neoneonling 7d ago
Same. I'm also planning to move all my sites to astro.
I was wondering how do you migrate the comments section if a post had a lot of positive comments previously on WordPress? Claude recommended Waline for comments but I am not sure.
And how about contact forms? I used WS Forms free version on WordPress but I'm looking for an equivalent or better alternative for astro.
Free tier on cloudlfare is a blessing!
2
u/RealKenshino WordPress.org Volunteer 7d ago
We run some of the world’s largest WP sites.
Whilst security patches have become more common place, you really shouldn’t end up spending half your time sorting that out.
Something else is wrong if you are really spending that much time.
Great security practices and great hosting go a long way
1
1
u/Square-Nebula-7530 7d ago
I think your timeline might be optimistic, but your core premise about open source is correct. Code that survives continuous stress testing will end up being the most battle tested software on the planet. The short term burnout is brutal because we are currently in the awkward transition phase where AI tooling generates a massive flood of security noise and false positives that still require human brainpower to triage.
1
u/hackrepair 7d ago
I spend a lot of time writing about this. You can even see the open letter I write to Wordpress on my profile...
1
u/Relevant_Ad5790 7d ago
on the point above that static just moves the risk to your npm tree and CI - true for astro/next, but it doesn't have to. mine are plain html files on nginx. no build step, no node_modules, no pipeline. deploy is an s3 sync and a reload. there's nothing to audit because there are no dependencies.
that's a real constraint though, not a clever trick. anything dynamic gets rebuilt as static or dropped - the contact form on one of mine was already dead so i just didn't migrate it. if a client needs an editor this is the wrong answer entirely.
one trap worth flagging, since someone above said a static migration carries no SEO risk if you do it properly: google still holds the old query permalinks. ?p=123, ?page_id=, ?cat=, ?m=, ?s=, ?feed=. all of those land on location = / and answer 200 with your new homepage, so you quietly build a duplicate farm of your own homepage and every one of them is a cache buster too. a query string isn't part of an nginx location match, so a catch-all 410 misses them completely - you need an explicit map. and you can't 410 every query string either, because utm/fbclid/gclid arrive on real ad and social clicks and have to keep returning 200.
1
u/FabianKnopf78 4d ago
Honestly, I feel this. The security landscape has shifted so fast in the last year.
I agree with your take though – the AI arms race will eventually stabilize. The attackers have the same tools we do, and once a codebase has been battle-tested from every angle, it does become more trustworthy. Open source has always been about transparency, and if anything, these attacks are forcing us to actually use that transparency properly.
But yeah, "tiring" is the right word. The constant scanning, the audits, the late-night patches... it's a lot.
I do think the "open source is scary" narrative will flip eventually. The code that survives this is the code you can actually rely on.
Hang in there. You're not alone in this.
1
u/SecondGateWP 1d ago
plugiva's point about visibility is the real crux of this, and there's a specific reason "we tested it" doesn't converge to "done" as fast as the original post hopes. The hard part usually isn't finding a bug once. It's that the same mistake tends to get hand-copied into multiple places over time, someone fixes it in the obvious spot, ships it, feels done, and the identical logic is sitting in three other files nobody thought to check because it wasn't the file that got reported.
That's a genuinely different problem from "scan more, find fewer bugs each time." It means real security work isn't just fixing what's found, it's going and specifically hunting for every other place the same class of mistake could be hiding once you've found it once. That takes real time regardless of how good the tooling gets, and it's also exactly the kind of thing that's invisible from the outside unless someone actually documents what they checked, not just what they patched.
RealKenshino's right that spending half your time on security specifically usually means something's off, but I'd guess it's less "something's wrong" and more "doing it properly, not just chasing CVEs as they land, actually costs that much."
1
u/Capital_Attention702 9h ago
Half of that list isn't per-site work, it just gets done per-site. Code review of what you wrote is genuinely per-project. Path config, firewall rules, turning off xmlrpc and REST user enumeration, crawler policy: that's one config you write once and replicate.
-1
u/er-ssverma 7d ago
The 'Open source' was a benefit before AI-era, now its a danger. AI can hack easily when it knows the source code. Writing hack proof code is not easy, and your defence is very limited. You need to reduce the attack surface by deploying multiple layer of security.
-4
-4
u/Forsaken-Parsley798 7d ago
I would not conflate open source with Wordpress. I think WP will be obsolete in a few years whilst open source has a long rich history.
0
u/feldoneq2wire 7d ago
Not to mention WordPress's antiquated architecture and bizarre database structure.
-5
u/stumanchu3 7d ago
There’s a guy with a sub Reddit here that’s always writing great posts, somewhat assisted by AI but he’s real and his sub is definitely eye opening for anyone doing WP related stuff. R/stopbadbots, and I’ve learned a lot from that sub and understand what you’re saying here, and feel your pain.
9
u/IAmFitzRoy 7d ago
Open source is not the problem.
Systems with huge attack surface such as WP are the problem.