Wpcom – A curated directory of resources and tools for WordPress | Hacker News Reader

Wpcom – A curated directory of resources and tools for WordPress

wpcom.org

24 pointsatknoz15 comments

This is a shameless self-plug. I have written a few WP plugins because it is not as secure I wanted it to be:

- WordPress does not come with proper password hashing, and uses the phpass library. https://wordpress.org/plugins/password-hash/ will change this to use bcrypt/Argon2ID

- Comment forms do not have CSRF tokens, and hackerone/tickets for them have been neglected as trivial. https://wordpress.org/plugins/comment-form-csrf-protection/ This plugin adds a CSRF token to comment forms.

Proceed with caution. A fair amount of wordpress's reputation for bad security comes from 3rd party plugins. There aren't many (any?) restrictions on what they can do.

That's right indeed but we're a curated directory where people discover or share their experiences on the resources. We're not encourage the peoples to use what we've curated.

Well, is exactly the same for any npm package or any python package as do many other languages, a lot -if not all- bad security comes from 3rd party plugins.

I'm perfectly capable of bad security on my apps without the use of 3rd party plugins, thank you very much!

Technically the same perhaps. But the actual history is pretty different. WordPress plugins are notorious for RCE type vulnerabilities.

I wrote one during my early years, in fact [1]!

1: https://jeremyaboyd.micro.blog/2016/11/20/that-time-i.html

Kinda surprised not to see WPengine on the list.

There is actually: https://www.wpcom.org/resource/wpengine/

Though we don't recommend it due to bad pricing policy, bad reputation on TrustPilot and from other testers, and personal experiences. There are way better hosting alternatives that is currently listed and marked with yellow background on our platform.

How slow does WP get if you load all of these onto it at the same time? How much would it resemble a Swiss cheese, security-wise?

Load all of these? Why would you do that?

Not sure why you'd do that, or why that's related. Caching would take care of any plugins on the backend.

WordPress does not support PHP autoloading, and every plugin's main PHP file is included and run on every page load.

If you have a 100 plugins, that is WordPress core files + at least 100 files to run.

You will likely run into functions name collisions before you can run it. PHP also caches the opcode to the memory. So it's likely that you will hit memory or disk IO issues before you can do it.

WordPress has wp-cli that you can download plugins from CLI. Give it a try yourself, although I don't see the point of it.

Is the Wpcom site itself a theme?

It's a custom built theme by us.

Reply on news.ycombinator.com