Do we need a dedicated WordPress security group?

[u/VanSage]

With all the recent security issues stemming from ai and whatever else in the WordPress environment, and so many threads in this group being security focused, I wonder if a dedicated WordPress security group is in order.

No, I'm not suited to create it, but would be willing to be involved in moderation.

[u/RealKenshino]

Nope, don't think that requires a separate sub. Feel free to of course.

Added a new flair for Security though so let's see how that works out!

[u/bluesix_v2]

I’d love if there was another sub for people to go and post their “i got hacked because I didn’t keep my plugins up to date. Here’s an AI slop post on what happened” posts.

[u/TalesfromCryptKeeper → u/bluesix_v2]

"Is anyone else experiencing this? How do you deal with it?"

🫠

[u/bluesix_v2 → u/TalesfromCryptKeeper]

gEnUInelY cUriOuS

[u/Disastrous_Club4942]

https://make.wordpress.org/security/2026/08/28/the-core-security-initiative/

[u/Inside_Marsupial9625]

would be something to discuss. Moderators should be experienced wordpress devs, not anyone who says he makes websites

[u/VanSage → u/Inside_Marsupial9625]

I think moderators should be mostly security specialists. The best I could offer would be some of the grunt work of removing very obvious bot posts and those obviously breaking group rules.

[u/RealKenshino → u/VanSage]

Security specialists are already in the WordPress security team. They are not interested in running a sub. WordPress.org is where they would work with people

[u/yabezuno]

im starting to move out of wordpress.

too much stuff to keep updated for simple sites.

for Ecommerce shopify is good.

for blogs, standard CMS is good.

If a client wants control of a CMS for content management, comments and user control, maybe thats where I would go back to wordpress.

But regular sites doesn't seem to be it anymore

[u/Raju_DM]

yes it might be helpful

[u/paumpaum]

And like most enshitification, it'll end up costing everyone more than they can afford.

Why not build it? Like all of the other half assed and money grubbing solutions?

I switched to static ... No more problems.

[u/chaoticbean14 → u/paumpaum]

Amen. You will get downvotes because this is a WP sub and anyone with any common sense, or data that doesn't showcase WP in a good light gets downvoted.

A security group should have been a thing years ago. 20,000+ WP sites are hacked daily. AI is only exposing what a dumpster fire the WP ecosystem has become over the years. The plugin ecosystem only makes it that much harder to try and keep things together - and given how many 'plugin maintainers' are really bad developers and how many plugins a WP site requires to be competitive in the modern web? Good luck. It's a losing battle.

I (like you) switched to static. Only have a small number of clients still on WP. Some day we'll get them off of WP and be done with it entirely.

[u/paumpaum → u/chaoticbean14]

I agree. Had to abandon WP after nothing worked to keep it from being hacked every few minutes. Tried everything that I could, until I finally realized that the system itself is insecure.

I changed my sites to static and haven't had a single problem since. Nothing to hack. No tricky bits that people more clever than I am can exploit. It's going to get so much worse as AI pentesting becomes more prevalent.

[u/dirtyoldbastard77 → u/chaoticbean14]

20000 sites out of how many million sites?

[u/chaoticbean14 → u/dirtyoldbastard77]

That's 20,000 sites per day. Yes, there are millions of sites, but seriously... that's a big, big number. That means in roughly 2.7 years... 20 millions sites will have been potentially been compromised.

Name another CMS with that kind of terrible statistic that constantly gets recommend to newer individuals who have no clue what actual security looks like, I'll wait. Actually, no, I won't wait because then I'd be here for a long, long time. Instead of working on fixes for this kind of thing or finding a way to moderate plugins and enforce quality standards... we get "builders". Instead of working on the shitty DB schema we get more bloat.

WP is hot garbage these days. Once upon a time? It was slick, it was new, it was faster, lightweight. In modern times? It's a sinking ship filled with holes. No thanks.

[u/theguymatter]

Moderating for free is generous, but honestly, you might just be wasting your time. You have a life and other things worth focusing on. Unless there’s some incentive, it’s a lot of ongoing work for nothing.

[u/townpressmedia]

If you can't handle security in house - YES!

[u/flybot66]

"claude check this site for suspicious activity. harden the site going forward"