Reply to thread

[USER=3505]@craigh[/USER], thanks again for the positive feedback.

I think that your argument that WordPress isn't an ideal platform can be spun pretty easily though. As you mention Drupal and Joomla are vulnerable as well as a slew of online software. I would go so far as to say any web based software that can be accessed by a Windows computer can be vulnerable. Hell, the entire internet isn't secure. Just ask Target or any online banking site how well they are doing at staying secure. In my opinion, being hacked isn't a matter of if, it's when. Based on that WordPress then becomes the perfect solution since it is completely portable. You can have a new site up in a matter of minutes with the correct strategies in place.

That said, in the last 9 years of having car dealer sites on WordPress (easily over 1000) we have only seen a handful get hacked. In every instance these sites hadn't been updated in a year or more which was the fault of the site owner not the software. I have never experienced a site getting hacked because of a plugin personally, but we have settled on a well vetted group of plugins that we use too.

The one thing that I recommend to anyone that is starting a WordPress website is to pick the hosting and security strategy first. Here are a few steps to doing WordPress right.

• If you don't know anything about WordPress or technology in general use a WordPress specific hosting company that offers security and backups like WPEngine. Even if you do know what you're doing, but would prefer to outsource the server side of things this is a good strategy (this is who we use btw).
• If you have some knowledge and want to save some money use an inexpensive hosting company like SiteGround or Hostgator. Use a backup tool like Updraft (save scheduled backups off site and keep at least one base copy). Then use a free version of Cloudflare to manage your nameservers so you can block entire countries and repoint in seconds if needed.
• Backup and update regularly. If you aren't going to do this manually it is possible to automate.
• If you want to use a new plugin, test it on a sandbox site and do some basic research before putting it on a production site.

The reason WordPress gets a bad rap at all is it is running 70 million sites (or something like that) and probably half of those have been abandoned by the site owner. Because it's so easy to setup, it creates a problem where site owners don't take full responsibility for security. Take some time to do it right and WordPress can run sites doing a million plus hits per month just fine.