2

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com.

Now there is a requirement that the blog appears as www.mainsite.com/blog. I can install PHP, MySQL and Wordpress on our main website IIS server; my question is if there are any security and performance concerns? Every now and then, a new vulnerability is found in Wordpress and PHP; Is it fine to bring such vulnerable technologies to our main web server? Can someone tell "if the admin account of the wordpress blog gets compromised, can this cause any issues for the main web application?"

and if it is a bad idea to bring a new stack of technology to our main IIS web server, how can we achieve www.mainsite.com/blog instead of current www.blog.mainsite.com?

Improve this question
3
  • You could configure the main web server as a reverse proxy for /blog to proxy requests to the VM running Wordpress.
    – user42178
    Commented Jan 2, 2015 at 21:13
  • How bad the performance overhead of a reverse proxy would be? We have reservations because it can make page load considerably slower.
    – Goli E
    Commented Jan 2, 2015 at 23:33
  • Not much impact in terms of performance. Try it and see.
    – user42178
    Commented Jan 3, 2015 at 12:01

2 Answers 2

Reset to default
6

Installing more software on any machine (almost) always increases the number of ways the machine can be attacked. So it is generally good practice to segregate components when possible. Suppose there is an attacker can use a flaw in the wordpress blog to execute PHP code, now the server hosting your main site is owned.

Another issue that comes to mind with this new setup is that hosting the blog on the same domain as your main site can give the blog access to cookies set by your main site. So now these cookies might be vulnerable to XSS attacks on the wordpress site, when they would not have been if the main site was hosted on www.example.com and the blog on blog.example.com.

EDIT:

Since you asked: I believe the admin on a wordpress site can install plugins/upload php files, so if this account were compromised then the machine would be compromised as well.

Improve this answer
3
  • Good point about XSS. In case the admin account of wordpress is compromised, what attacks the attacker can cause against the main web application running the same server?
    – Goli E
    Commented Dec 29, 2014 at 22:26
  • thanks a lot. I am wondering, why the plugins for Wordpress would allow accessing the platform; can you infect the platform running wordpress with plugin that allows uploading malware?
    – Goli E
    Commented Dec 30, 2014 at 20:41
  • 1
    an attacker could probably write his own plugin that did whatever he wanted and then install it on the wordpress account
    – Jon
    Commented Dec 30, 2014 at 22:49
1

An alternative would be to use IIS' application request routing service as a sort of proxy to the web server.

Here is some information:

Application Request Routing:

Using ARR as a forward proxy:

Being that there isn't anything particularly fancy being done from the user facing side, this setup should work without issue.

** The second article has exactly what you're looking to do in it.

Improve this answer
1
  • Can you give more details? We like to redirect users visiting blog.example.com to example.com/blog, without moving blog to a directory of the example.com; while the goal is to increase the traffic to example.com
    – Goli E
    Commented Dec 30, 2014 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .