FarCry CMS

Every popular content management system gets attacked. WordPress, Drupal and Joomla are all widely used, so all three attract attention. The question for anyone comparing platforms is not which one is never targeted. It is which one you can keep patched and locked down with the time and skills you have.

The Australian Cyber Security Centre (ACSC) has published guidance on securing content management systems. It is short, practical and written for organisations that run their own sites. This article works through its main points and what they mean when you compare platforms.

Why CMS sites are compromised

The ACSC guide says most CMS compromises are opportunistic. Automated tools scan the internet for weaknesses, and sites with poor security are the ones that fall. In other words, attackers are often not after you in particular. They are after any site that has not been looked after.

The damage can go well past a defaced home page. According to the guide, attackers can reach logged in and privileged areas, upload malicious files such as web shells and inject harmful content into real pages. They can also exploit the trust visitors place in your site. A hacked site may even be used to attack others.

Patching every layer

The guide asks site owners to set up a process to test and deploy patches. That covers the CMS core, the server operating system and third party parts such as themes, frameworks and libraries. Custom code needs the same attention. One weak component can be enough to compromise the rest.

This is where platforms and hosting setups can differ in practice. Ask each option how updates are delivered and whether minor releases install automatically. Then ask who will test and apply the larger ones. A platform with good tools is no help if nobody presses the button.

Plugins, themes and extensions

Extensions are what make a CMS flexible. They are also a common weak point. The ACSC recommends using trusted, supported third party plugins and switching off functionality you do not need. Every extra plugin is more code that could hold a flaw.

When comparing platforms, look at how extensions are reviewed and how long they are maintained. A large extension library sounds attractive, but quality varies. Check when an extension was last updated and whether it supports the current version of the core software. A smaller set of well kept extensions is often safer than a long list of abandoned ones.

This applies to the most common choice for small firms as much as anything else. If you are weighing up WordPress for small business websites, plan which plugins you really need before launch. Fewer moving parts means fewer updates to track.

Accounts and admin access

The guide is direct about accounts. Change default usernames and passwords, including those for related services. Use strong passphrases, and check that the system stores them as salted hashes rather than plain text. It also suggests limiting access to the admin area to approved or internal IP addresses.

That last point is worth comparing between platforms and hosts. Some setups make it easy to restrict the login page, while others leave it to the server. If your team works from many locations, ask what other controls are available. Strong passphrases on every account remain the baseline.

Hardening and hiding details

Hardening means removing anything an attacker could use. The ACSC suggests switching off detailed debug and error messages and removing test pages such as phpinfo. It also suggests removing version details from page footers and meta tags. The guide notes that the CMS type and version can still be fingerprinted, so this is a small step rather than a fix.

Each platform has its own hardening advice. The ACSC points readers to vendor guidance for Drupal, WordPress and Joomla, as well as OWASP. Reading that guidance before you choose tells you a lot. Clear and current security documentation is a good sign the project takes it seriously.

Checking for weaknesses

The guide recommends scanning your installation with tools built for that CMS. It names WPScan for WordPress and the Security Review module for Drupal as examples. Custom code and modules should be assessed as well. Asking whether such tools exist for a platform is a fair test when comparing options.

Monitoring changes

The final group of recommendations is about knowing when something changes. The ACSC suggests change management for new versions of web content and source control for custom code. It also recommends file integrity monitoring to spot unauthorised changes to pages. A hacked page found in hours does far less harm than one found weeks later.

Managed hosting versus running it yourself

One of the first recommendations in the guide is to consider managed CMS hosting. A managed service maintains the infrastructure and applies patches promptly. For government customers, the ACSC notes that GovCMS is available for Drupal sites. For a business, the same idea applies.

Running the site yourself gives more control, but the patching, scanning and monitoring all become your job. A managed service takes much of that away, though often with limits on what you can install. Neither is wrong. The right choice depends on who you have to look after the site week to week. If you are still deciding between a simple builder and a full CMS, our piece on why WordPress is better for your website covers the wider pros and cons.

Security also supports visibility. A site that is defaced or flagged after a compromise can lose trust fast, which undoes the work behind getting recognised on the web using WordPress. It can also set back your wider online marketing plans while the clean up happens.

What to compare, in short

When security is part of your comparison, ask each option the same questions. The list below is drawn from the ACSC guidance. A platform or host that answers them clearly is usually easier to keep safe.

• How are core, theme and plugin patches tested and applied?
• Are extensions reviewed and actively supported?
• Can admin access be limited to approved addresses?
• Can debug messages and version details be switched off?
• Are scanning tools available for this CMS?
• Is file integrity monitoring or change tracking available?
• Is managed hosting an option?

You can read the full ACSC guide to securing content management systems for more detail. It also points to the Essential Eight and the Information Security Manual for broader advice. They are a good next step once the basics are covered.

Frequently asked questions

Is one CMS more secure than the others?

The ACSC guide does not rank platforms. It points to vendor guidance for WordPress, Drupal and Joomla alike. Its advice focuses on patching, extensions, accounts and monitoring. How a site is run matters more than which logo is on the login page.

Why do small sites get hacked?

The guide says most compromises are opportunistic. Automated tools scan for weak sites rather than chasing particular targets. A small site with old plugins can be found just as easily as a large one. Keeping everything updated removes many of the easy openings.

Does hiding the CMS version stop attacks?

Not on its own. The ACSC suggests removing version details from footers and meta tags, but notes the CMS type and version can still be fingerprinted. Treat it as one small layer. Patching is still the main defence.

Is managed hosting worth it?

For many small teams it is a sensible choice. The ACSC suggests considering managed hosting that maintains the infrastructure and applies patches promptly. The trade off is often less freedom to install what you like. Weigh that against the time you have for updates and monitoring.

Sharing is caring!