Tell your client to read up on cybersecurity, because his premise is nonsense. Security through obscurity has been discredited since 1851 (yes, that’s one and a half century ago). The opposite is also untrue. Open source software is not more secure than proprietary software.
The crucial thing in code security is not whether it’s open or not, but whether it’s well maintained. WordPress has an active community that is constantly alert on security matters. Follow the guidelines. Ask yourself how alert the authors of a rival cms are.
That said, security is a constant threat. There are no proofs or guarantees.
Related Posts:
- what is a auth_user_file.txt?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
- How to view PHP on live site
- Is moving wp-config outside the web root really beneficial?
- Hide the fact a site is using WordPress?
- Verifying that I have fully removed a WordPress hack?
- WordPress 4.7.1 REST API still exposing users
- Can I Prevent Enumeration of Usernames?
- Best way to eliminate xmlrpc.php?
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Should I remove install.php and install-helper.php?
- Are Nonces Useless?
- What is the difference between esc_html filter vs attribute_escape filter?
- WordPress it’s cleaning a custom query_var to avoid sql injections?
- How do WordPress Nonces Work?
- Tips for finding SPAM links injected into the_content
- Close a wordpress blog – keep site as it is but prevent hacks
- Is WordPress vulnerable to the httpoxy?
- How can I easily verify a core or plugin update has not broken anything?
- Vanilla WordPress install, what can/should I put in disable_functions?
- wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
- WordPress and Security
- Secure my “add_settings_field” translation?
- Is there a security risk giving someone temporary access to my blog’s code?
- How to properly sanitize/secure a WP Query coming from the front end
- WordPress Logout Only If User Click Logout or If User Delete Browser History
- brute force attack even though it is limited by IP
- How brute-forcer knows that the password is cracked for target username?
- How do I authenticate WP users from a chrome extension?
- wp_insert_post disable HTML filter
- Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
- Completely remove the author url
- Restricting access to content
- About WordPress site security
- Relative security of different releases of WordPress
- Is there any point setting the keys and salts in wp-config.php?
- Where to store OAuth 2.0 client id and secret?
- Registration Plugin – Recaptcha integration
- How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
- Using HTACCESS for Secret Access
- Definitive wordpress directory ownership and permissions on linux
- Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
- Changing Table Prefixes – once done, am I good to go going forward?
- wordpress website host price and security [closed]
- Is there value in using a wp_nonce for POST requests?
- Are there security risks in working directly in the themes folder that builds into a theme folder?
- How to hide easy access to my website temporarily?
- Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
- Secure WordPress: Change admin
- Changing the default header name
- how much information can we hide when using wordpress cms?
- Is it safe to use a global wp nonce per user instead of a nonce per action?
- Wordfence detects change in wp-admin/includes/upgrade.php
- Basic password protection without using users and roles
- System setting changed by system user
- Any any insecure http:// URLs left in wordpress?
- Does meta-data need to be sanitized?
- Will there be security updates for WordPress 4.9.9
- White screen of death on admin pages after moving wp-config up two levels for security
- Any known bugs that could cause disappearance of the wp_users table?
- On new server, site got hacked, permissions a bit strange? Please help
- 404/500 error on content images if Referer header is from another domain [closed]
- Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
- Restrict Access without Creating Users
- Switching between security plugins is a risk?
- How to obfuscate wp-config.php or code
- Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
- How to prevent to direct access of my custom plugin folder/files
- Checking for origin of a xmlrpc request
- RESTRICT EDIT of PHP files?
- wp-content – permissions for files/folders created by apache
- How can I restrict access to specific parts of a page, not just the page itself?
- User generated content and security
- Are major WordPress updates mandatory for security?
- i moved wp-config.php outside of public html and this broke my website
- Monitor wordpress all external calls
- Is it safe to use the basic administration with reduced rights for private member space
- Securing WordPress running on Azure platform
- Verifying that I have fully removed a WordPress hack?
- Spam Registrations
- How can I have more confidence that WP plugins aren’t getting and storing user data?
- Standard Method for Securing a WordPress Site
- wordpress security (only one part of the site)
- wp-config.php moved above root results in no plugin updates
- Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
- Any way to disable /wp-login.php redirecting to the site folder?
- Folder Permissions + Security Concerns
- Malware/Permission bug removal?
- Could a user account with a stolen password compromised entire WP site?
- Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
- Secure a WordPress website in 2019: one plugin or a combinations of them?
- What are the different types of firewall protections available for a WordPress website?
- is this code properly secured
- Run a security scan on WordPress site that has .htaccess password [closed]
- Is this a WordPress security bug?
- Competitor is somehow accessing MetaData on a hidden WordPress site
- WordPress Hacks/Defacing [closed]
- Possible to change email address in keypair?
- SSH keypair generation: RSA or DSA?
- Why is SSH password authentication a security risk?