Matt Mullenweg, fondateur de WordPress, répondait cette semaine à une discussion sur la plateforme Quora à propos de la pertinence d’ulitiser WordPress pour créer un site de banque.
In terms of security, there are a two simple points:
Make sure you’re on the latest version of core and all the plugins you run, and update as soon as new version become available.
Use strong passwords for all user accounts. For extra credit you could enable a 2-factor plugin, use Jetpack’s WordPress.com login system, or restrict logged-in users to a certain IP range (like behind a VPN).If your host doesn’t handle it, make sure you stay up-to-date for everything in your stack as well from the OS on up. Most modern WP hosts handle this (and updates) for you, and of course you could always run your site on WordPress.com VIP alongside some of the top sites in the world. If you use any non-core third party code, no harm in having a security firm audit the source as well (an advantage of using open source).
For an example of a beautiful, responsive banking website built on WordPress, check out Gateway Bank of Mesa AZ. WordPress is also trusted to run sites for some of the largest and most security-conscious organizations in the world, including Facebook, SAP, Glenn Greenwald’s The Intercept, eBay, McAfee, Sophos, GNOME, Mozilla, MIT, Reuters, CNN, Google Ventures, NASA, and literally hundreds more.
As the most widely used CMS in the world, many people use and deploy the open source version of WordPress in a sub-optimal and insecure way, but the same could be said of Linux, Apache, MySQL, Node, Rails, Java, or any widely-used software. It is possible and actually not that hard to run WordPress in a way that is secure enough for a bank, government site, media site, or anything.
Intéressant d’ailleurs de lire dans les commentaires plusieurs exemples de banques utilisant WordPress:
Getaway Bank of Mesa AZ
Southtern Bancorp
Oaken Financial
Middelfart Sparekass
Lake City Bank
Cornerstone Financial