Is WordPress MultiSite secure & how much can it scale? [closed]

Is WordPress MultiSite secure & how much can it scale?

WordPress.com — single best example of WordPress Multisite at a large scale. Period.

As for the expertise to be able to maintain and manage the cluster — which you should question yourself — it’s a different story.

By creating admins for each subdomain, what security concerns should
we have and how to we address them?

I won’t answer that directly. But what I can tell you is, sometimes vulnerabilities aren’t noticed until some big blog/network gets hacked. You better have measures in place. Hope for the best, prepare for the worst.

Related Posts:

  1. What is the difference between a cer, pvk, and pfx file?
  2. Is it possible to decrypt SHA1
  3. Error `sec_error_revoked_certificate` when viewed in Firefox only
  4. Why should I use the esc_url?
  5. Where to securely store API keys and passwords in WordPress?
  6. Why escape if the_content isnt?
  7. Full path disclosure on rss-functions.php
  8. What to use instead of wp_kses() in user output
  9. Are the default salts secure?
  10. is_email() VS sanitize_email()
  11. Subscribe to email for security fixes?
  12. How to hide admin account in BuddyPress? (for security reasons)
  13. How to escape custom css?
  14. Understanding SVG vulnerabilities in WordPress related to a specific fix
  15. Moving wp-config.php: Can this be done after site launch?
  16. How to secure or disable the RSS feeds?
  17. Delete sites in wordpress multisite (not suspend)
  18. How to synchronize user profile fields in multisite?
  19. Make password invalid once logged out of password-protected page
  20. How to get WordPress to save upload file beyond web root [closed]
  21. Is security a problem in WordPress?
  22. Moving wordpress out of the public directory
  23. Logout via Subdomain, non-wordpress page on a different server?
  24. Get first_name and last_name on user_register hook
  25. User registration on subsite in multisite configuration
  26. Can you have multi-site WP and keep users separate?
  27. Protecting HTML5 video [closed]
  28. How can I tell who changed the password?
  29. How to use wp_set_password in a plugin?
  30. WordPress website Security [closed]
  31. Do I need to use the esc_html() function on hard coded links?
  32. Can’t reset WordPress password
  33. Is the “lost password” feature truly a vulnerability?
  34. Deleting a user in multisite
  35. Frontend Password change
  36. Is it possible to reduce the minimum character length for passwords?
  37. Handling email piping attachments and detecting unsupported file types
  38. Downloading File from Outside Web Root
  39. Cookie nonce is invalid – Multisite
  40. site get login attempts after htaccess ip restriction
  41. Is it good security advice to install wordpress in subdirectory but link to root?
  42. Why was my blog post inserted lot’s of ad links by others?
  43. Moving wp-config.php up 2 levels
  44. How Could I sanitize the receive data from this code
  45. WordPress SQL Injections through User Agent
  46. Should I Worry About SQL Injection When Using wp_insert_post?
  47. Is there a way for a user to have an alias?
  48. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  49. WordPress Multisite plugin delegation
  50. What permissions should I give directories if I want to make WordPress more secure?
  51. Security threat with `home_url`?
  52. When is wp_set_password() called or how to capture a password
  53. How to protect wp-admin through .htaccess?
  54. Something is unescaping all html entities before output to browser [closed]
  55. Add menu items/actions for multisite users who are registered on the network but do not have a role or capability in any sites
  56. Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
  57. Multisite User Sync Question about blog authorship
  58. How to get WordPress to send Password Reset Link Email instead of New Password?
  59. Preferred method of setting user role only works on Main Site in Network
  60. Good way to block users within a multisite setup without deleting them?
  61. Verifying that I have fully removed a WordPress hack?
  62. Large Session Tokens
  63. How to change permissions of WordPress and/or apache on macOS securely?
  64. Using an Encryption class in a WordPress Plugin
  65. single sign on for wordpress multi site
  66. Limit Login Attempts BEFORE PHP is executed?
  67. Which Versions of WordPress Ship with the Patched TimThumb?
  68. Safe to say WordPress security releases don’t have database upgrades
  69. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  70. fail2ban to prevent Brute Force Attacks on WordPress?
  71. Use Google authentication for pages within a website [closed]
  72. How to give the same error message when the wrong password or wrong username is used?
  73. should I escape a literal url added in functions.php
  74. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  75. Adding Security Keys?
  76. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  77. Secret keys in SCM
  78. Secure Server after configuration
  79. Uploading attachment (pdf) and prevent download for anonymous user
  80. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  81. Specific Page/Post Need to Stay Non SSL
  82. WordPress API – sign-up to multiple Multisites from one single form
  83. Block JSON access over the net
  84. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  85. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  86. Security: AWS (shared hosting) claims template file malicious
  87. How to check whether a site has been compromised without browsing into it?
  88. My site thinks it’s secure when it is fact not
  89. Is it possible to only have the admin interface bind to the local loopback?
  90. PHP Code Sniffer – WordPress VIP Coding Standards
  91. Trying to understand nature of hacking
  92. Best way to convert two single WordPress sites into Multisite network with shared user base
  93. Default installation permissions for wp-config.php
  94. Correct setup to block file modifications from hackers
  95. Is my WP site being hacked?
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH