[drunken-serval]

Or go to the dark side and install Wordpress.

It’s actually not as bad as I thought it would be. I modified one of the twenty-x themes that come with it and installed a few plugins to make a decent personal site. It took less time that it would have to create anything with remotely similar functionality.

I run it off a single vps that has no other purpose. If it gets hacked, nothing of value is lost. I can revoke the api keys for the external services I use and restore to a new server from my backups.

[x3haloed]

More like the vulnerable side.

[bishalb]

WordPress used to be quite vulnerable a few years ago, but nowadays not so much, just avoid less popular plugins and you should be ok. Of course since it's the most widely used cms's out there, its a prime target for hackers. But the "WordPress is vulnerable" thing is much of a meme in the current day.

[web007]

You've got to be kidding.

https://wpvulndb.com/

Six security vulnerabilities in core WP just last month.

It's still a mess, and every plugin gives it a bigger attack surface.

[drunken-serval]

Any software has vulnerabilities. You have to keep the operating system on any server patched and set up basic defenses even for a static site.

[theamk]

Well, there are more and less vulnerable things.

For example, making sure that software cannot modify itself will ensure that even if server is vulnerable, it won’t get permanently compromised. Having a server that does not execute any file with right extension makes sure that sanitization errors do not lead to code execution. Having admin system be separate from main site makes sure XSS cannot cause compromises.

[stevenicr]

with a default wp install - you are right, however it's trivial to add a couple of security plugins and turn on auto-update.

adding the "ipgeoblock plugin" wipes out most attacks straight away.

with some of my wp sites that got attacked a lot on a regular basis, I use a 'static html generator' plugin - and delete all the wp php files -

no way to login, add comments or hack the wp core or plugins or themes, since they are not in use when you convert it all the static html.

On wp sites where I actually add content with regularity, I don't delete the wp files, and just use shield, sucuri, ipgeoblock, plugin things like that depending on threat.

[skittleson]

wordpress is great for quick sites. Long term maintenance is where I have been bitten.