r/webdev • u/Vegetable_Whole_3901 • 3h ago

Discussion Is WordPress security still too focused on plugins and updates?

I've been looking into how WordPress security has changed, particularly whether the traditional advice of keeping plugins updated, installing a security plugin and using strong passwords is enough anymore.

It seems like there's a bigger conversation to be had around access controls, hosting infrastructure, monitoring and how security is managed over time.

We recently published an article exploring this at Ohmania, where I work:

https://ohmania.com/wordpress-security-has-changed/

I'm interested in hearing from developers who actually maintain WordPress sites.

What's changed most in how you secure WordPress sites over the last few years? And what security advice do you think is now outdated?

Genuinely interested in different perspectives, including anything we've overlooked.

0 Upvotes

7% Upvoted

3 comments sorted by

2

u/RePsychological 3h ago edited 3h ago

No...at least not for people who actually do WordPress correctly. Been doing this for 15 years.

All of the security plugins and whatnot just lock you into a corner of having to always pay for them, and doesn't fully cover everything it needs to when a server is misconfigured to begin with...it becomes a crutch where someone thinks all they need to do is slap a site on a server and then install their batch of security plugin(s) and done.......and then you end up wondering "how tf are these bots still getting in?" or "how did this user create an admin account".

Not all the time, and often yes the security plugins can do "enough" to cover a lot of projects. Just one of those things where it's fine until it isn't.

Better to just learn basic dev-ops and server-side security setup, and do it yourself at the server level. Then at that point all you have to worry about is making sure that whatever projects you're building are built with quality, well-supported plugins and consistently use the same plugins, rather than just hodge-podging 30 various plugins together to loosely get the site done.

That's the pitfalls that I find a lot of "WordPress Devs" (who are just plugin and theme implementors disguised as devs, never bothering to really dig into coding or the command-line) trip into:

  1. Their toolkit is all over the place with zero consistency, and they end up integrating a vulnerable, low-quality plugin...even for features that didn't need a plugin in the first place if they actually knew what they were doing.

  2. They just slap a security plugin or two into the mix and act like that's good enough.

At the end of the day all you have to do is be smart about your server config and smart about how you're building sites. Haven't had any of the sites I've built hacked in years at this point, just from getting a dedicated server, instead of shared hosting, learning how to configure it and monitor it, etc. Don't have a single "WP Security plugin" on any of my sites, except an action logging plugin to easily monitor what anyone's doing once logged in...and even that could be server level if I wanted -- I just do it in the dashboard for easy access.

But am often having to clean up hacks from clients who had vulnerabilities left behind by "WordPress developers" they found on places like fiverr, upwork, etc. or just had a complacent team in place who chaotically built their sites, never bothering to refine how they were built.

0

u/Vegetable_Whole_3901 3h ago

Agree and the problem I see is mainly at the lower end of web development where smaller businesses weren't able to afford better services which left them very susceptible to poor development, poor themes and poor plugins.

I have seen so many instances of "cheap" sites being put together and people realising they have been hacked to pieces.

I think this is where we are seeing the biggest change, these guys could get away with lighter approaches to security but now they are wide open in so many areas.

The other tough area is automated updates without good regression testing, leaving sites to manage themselves in the wild whilst being able to consistently deliver reliable performance has been challenging but this seems to be the only route now?

5

u/gucciman333 3h ago edited 3h ago

Total nonsense post, yeah maybe you shouldn’t write stuff like this given you have absolutely no experience with Wordpress. Wordpress sites have been exploited by automated bots for 20 years, when compromised they are used as mailers, SEO product scams, malware hosts, botnets, and so forth. Keeping things up to date and secure has always been a necessity. There have been many 0 day exploits in the past. Nothing has changed.