5:44 PM
I'm not convinced, I'll have to investigate, sooner or later. Anyway, I have a problem, or maybe lots of related problems, like a can of worms. Simple stuff, basic stuff, yet I've never been able to find convincing answers. To sum up, it might all start when someone asks you to "do something to make a WordPress website more secure"
The website hasn't been updated in years. So you might think "ok, we need to update it". But will that really make it more secure? If it hasn't been hacked so far, it's only because no serious vulnerabilities have been discovered. As soon as one is found, the website will be hacked even if it was updated. Unless you update it regularly. But since serious CMS vulnerabilities are often exploited within hours of being patched (or even before the patch, as zero-days)...
security would really be improved if you updated the website all the time, every day or rather every hour. But you can't do that manually (how could you?), you'd need automation (automatic updates). But automatic updates don't allow thorough testing