Amazing tirade

Hi –

I suggested to someone that they install WordPress, and they’ve had nothing but trouble, which I find astonishing. I’ve been using it since almost day 1 and have never had problems. I want to share what her hosting provider said and ask for some feedback about why her provider would be telling her this stuff. She’s asking me, and I’m just flabbergasted. I feel like my best friend has been insulted. I’ve been blogging on WP since 2003 and love it.

Here goes:

This is a WordPress site, right?

The best way to host a WordPress site is on a dedicated server with regular backups, so when the site gets defaced (or worse), you can restore it from backup. WordPress sites get hacked into constantly.

I only know one other person who has a WordPress site … it was defaced two weeks ago.

The error she is describing is the result of WordPres doing something that mod_security will not allow. mod_security is there to protect the server and the database. The only way to let WordPress have its way is to remove the mod_security rule(s) the WordPress is violating.

This weakens my servers’ ability to ward off attacks, which I see 20 to 30 times every day of the week. If you like, I will send you the log that shows those attacks.

Interestingly, the majority of attacks are directed towards your web sites.

and then this:
As I suspected, WordPress was violating a mod_security rule which protects against “PHP code injection via ARGS” … I just made an exception for the WordPress site. So now she can do what she has to do and the acme database is no longer secure against this form of attack.