Ask HN: How do you manage Wordpress? Most startups I see are using wordpress for their blogs, even if their programming stack isn't based on PHP. How do you manage wordpress security and updates if you host the blog in house? If not, what service do you use to maintain wordpress? |
If at all possible, use wordpress.com. Pay some $$ for the redirection.
Other outsourcers: Pagely. They're not terrible - they are middling in competence, we have occasionally had to tell them precisely how to do some simple thing - but basically we don't have to interact much, and that's THE DESIRED OUTCOME.
WordPress is a commodity these days, treat it like one.
(The reason to use WordPress: it is the best blogging platform these days, and is really good as a simple-semistatic-site platform, and it is commoditised with third-party developers and hosters growing on trees. In almost no cases are you actually going to have a legitimate need to reimplement blogging yourself.)
- Use a VPS. If you talk to Olly, author of "wpCop" http://wpcop.com/ and the VPSBible, he recommends CentOS. I believe it has a good reputation for security, for web hosting. Also Ubuntu & Debian are about as popular as CentOS for web hosting and they're probably just as secure, but choosing your distro is a big deal because they're all different.
- Automated backups of everything, and make sure you know how to restore everything. Backups of backups and offsite backups. So even if something goes wrong, you're not completely screwed. You need "offsite" backups because there's a million ways onsite backups can be lost, stolen, destroyed, etc.
- Configure MySQL to ignore remote connections.
- Don't use "admin" users for WordPress or MySQL. Is this really necessary? Probably not but it's fairly easy to setup.
- Don't use FTP, use ssh.
- I know a guy who was on vacation in a certain country and they totally destroyed his server. So be aware of your environment.
It's everything a competent server admin and webops person could handle, but if you're trying to build a startup, dedicating any resources towards that is just taking engineering talent away from building the business.
The only technical consideration you'd then be tasked with is managing your plugins. Some now have automatic point updates, but most do not. These you'll need to monitor, test, and upgrade yourself.
There's value in even outsourcing that, simple design updates and production tasks, implementing marketing and visitor tracking, etc.. When you're looking at that option, you can look to a firm (such as mine) that can take that on for you.
I think that's a fairly reasonable methodology for any web application or stack-- I run updates on most of my linux machines a few times a week, as needed, to edge out the would-be attackers (or fix other bugs I wasn't aware of).
I personally host the bulk of my stuff on a Linode VPS and just compartmentalize it into areas of duty and responsibility. My blog / portfolio gets the most attention right now from me, but stuff like my time tracking and CRM have their own areas that are "reasonably" separated from stuff like WordPress.
If you look back in history, the so-called "WordPress hacks" in the news had nothing to do with a flaw in WordPress. What actually happened was, like in the case of the Media Temple hack, the hacker got access to the MySQL database and obviously all the blog data stored in MySQL was vulnerable. There was never any indication that WordPress was the attack vector when all those big hosts were affected. So what can you learn from that? Don't use shared hosting. Shared hosting was never that reliable in the first place. From my perspective, the shift to VPS was a big leap forward in terms of uptime for most websites/blogs.
Another big problem was the "timthumb" plugin. But from 2004 onward, that was really the only plugin that caused widespread problems for WordPress blogs, as far as I can remember. Yes, some plugins are dangerous and maybe you want a service like sucuri.net if you're really concerned about bad plugins. But bad plugins are rare, IMO.
Also weak passwords, again not a WordPress-specific problem. People using FTP carelessly, I bet that's the issue most of the time.
I'm not saying security is easy, I'm just saying WordPress is generally not the culprit. If there was ever any major hack that made the mainstream news that I missed, please post the link.
2. Don't to get too fancy with too much customization (writing your own plugins, weird post types).
3. Using a less mature blogging engine has its own problems. Rolling your own blog engine is nuts.
4. You can find someone to write a wordpress theme for you pretty cheaply.
5. There's a reason so many websites run on wordpress.
6. If blogging isn't your core product, there isn't much point to using something nonstandard. Would you write your own E-Mail system? Why not just use the standard blogging system?
you have to watch for security updates and changes for almost every other thing you use in your work life(from OS to JS libs), why not just add wordpress and the few plugins you use to that list?