We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com.

Now there is a requirement that the blog appears as www.mainsite.com/blog. I can install PHP, MySQL and Wordpress on our main website IIS server; my question is if there are any security and performance concerns? Every now and then, a new vulnerability is found in Wordpress and PHP; Is it fine to bring such vulnerable technologies to our main web server? Can someone tell "if the admin account of the wordpress blog gets compromised, can this cause any issues for the main web application?"

and if it is a bad idea to bring a new stack of technology to our main IIS web server, how can we achieve www.mainsite.com/blog instead of current www.blog.mainsite.com?

  • You could configure the main web server as a reverse proxy for /blog to proxy requests to the VM running Wordpress.
    – user42178
    Jan 2, 2015 at 21:13
  • How bad the performance overhead of a reverse proxy would be? We have reservations because it can make page load considerably slower.
    – Goli E
    Jan 2, 2015 at 23:33
  • Not much impact in terms of performance. Try it and see.
    – user42178
    Jan 3, 2015 at 12:01

2 Answers 2


Installing more software on any machine (almost) always increases the number of ways the machine can be attacked. So it is generally good practice to segregate components when possible. Suppose there is an attacker can use a flaw in the wordpress blog to execute PHP code, now the server hosting your main site is owned.

Another issue that comes to mind with this new setup is that hosting the blog on the same domain as your main site can give the blog access to cookies set by your main site. So now these cookies might be vulnerable to XSS attacks on the wordpress site, when they would not have been if the main site was hosted on www.example.com and the blog on blog.example.com.


Since you asked: I believe the admin on a wordpress site can install plugins/upload php files, so if this account were compromised then the machine would be compromised as well.

  • Good point about XSS. In case the admin account of wordpress is compromised, what attacks the attacker can cause against the main web application running the same server?
    – Goli E
    Dec 29, 2014 at 22:26
  • thanks a lot. I am wondering, why the plugins for Wordpress would allow accessing the platform; can you infect the platform running wordpress with plugin that allows uploading malware?
    – Goli E
    Dec 30, 2014 at 20:41
  • 1
    an attacker could probably write his own plugin that did whatever he wanted and then install it on the wordpress account
    – Jon
    Dec 30, 2014 at 22:49

An alternative would be to use IIS' application request routing service as a sort of proxy to the web server.

Here is some information:

Application Request Routing:

Using ARR as a forward proxy:

Being that there isn't anything particularly fancy being done from the user facing side, this setup should work without issue.

** The second article has exactly what you're looking to do in it.

  • Can you give more details? We like to redirect users visiting blog.example.com to example.com/blog, without moving blog to a directory of the example.com; while the goal is to increase the traffic to example.com
    – Goli E
    Dec 30, 2014 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.