The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint most likely).

Is it true that our intranet would still possess security vulnerabilities even though it is restricted to internal staff?

  • I smell that this question is about how dangerous a vulnerable CMS is on the intranet versus Internet? Dec 7 '12 at 8:47
  • 1
    that is exactly right Dec 7 '12 at 9:06
  • If possible, I'd run WordPress as an isolated service or inside a VM with no outgoing access to the internal network. If you need LDAP to use users from Active Directory, then I'd allow that, but nothing else.
    – Matrix
    Dec 7 '12 at 10:25
  • Wordpress gets a bad reputation because of ( lets be honest here ) the major vulerabilities it has. Of course if you take an honest look at Sharepoint it also has major vulerabilities that have been patched. The difference I suppose is you hear less about Sharepoint because of how easy it is to update. Sounds like the comapny should just migrate to Sharepoint if thats what they plan on doing.
    – Ramhound
    Dec 7 '12 at 12:29
  • 1
    I know what you mean, but Sharepoint is more much more annoying to design and develop... Dec 7 '12 at 13:28

It would depend on the version of Wordpress, in general the idea is that you need to patch your software and harden it to make it secure. But it's not that Wordpress is any less safe than Sharepoint.

Wordpress is in general well maintained and CVE's are patched or fixed quite rapidly. So if you keep up with these then it's safe to use Wordpress. (do mind that you need to keep track of your plugins as well)

If you don't do this in general, then your Sharepoint will probably be as insecure as your Wordpress (or any other software that's on your Intranet for that matter).

But saying that software X is insecure without providing any facts to support the statement is a bit stupid.

EDIT To compare intranet vs internet, the likelyhood is lower, but the impact is the same as on the internet.

  • 2
    +1, though in my experience most CVEs come out of Wordpress plugins, which tend to get patched significantly less quickly.
    – Polynomial
    Dec 7 '12 at 9:19
  • 1
    Great info...So even if the intranet WP site is only available to a few internal IP addresses, as controlled via the .htaccess file, it still poses a security threat because of insecure plugins or an outdated WP installation? Dec 7 '12 at 10:27
  • Yes you don't know who might have access to your intranet Dec 7 '12 at 10:30
  • Oh ok. So are you saying that the vulnerabilities would be internal? Dec 7 '12 at 10:39
  • 1
    Regardless if your application is on the intranet or internet, if you it's vulnerable it can be exploited. This could be a rogue employee or someone who has access to your systems on the intranet or some hackers on the internet. Dec 7 '12 at 10:57

Wordpress is insecure as any other CMS. If you update the software regularly, do the basics for make your site secure (you should visir http://codex.wordpress.org/Hardening_WordPress) and do not let people fro outside access, you should have no problems.

Like any ohter product, is reasonably secure if you try to make it secure, if you only install the product and forget the security for years until something happens, any product will be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.