Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports.

As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone.

We need a new KISS: keep it simple, stupid, secure.

The "surprisingly secure" WordPress just had a unauthenticated RCE earlier this year. Just simplifying isn't going to be enough.

https://nvd.nist.gov/vuln/detail/cve-2026-63030

The reason is simple - nothing really bad has happened that we can point at and say "ah, shit, let's all learn collectively". I know it sounds naive when I say it, but there hasn't been a significantly consequential hack, leak, destruction, or anything related to cybersecurity where it led for concerns of people.

The main thing I can think of is cyber insurance, which requires a bunch of audits, and some checks maybe, and it changes some conditions whenever there's a big explosion. Whenever big leaks happened, data security and etc., nobody really went to jail, so nobody really cares. Everything can be brushed off, because it costs time to implement proper measures and adds friction / barriers in some cases. So in the end, there's a huge pushback against it. And I totally get it, to be honest.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

> as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports.

We've been trying that for years but the enthusiasm of developers and the eagerness of their employers fight against it. Worse, with coding LLMs it's now easier than ever to output a lot of code, fast.

It'll ultimately be up to more experienced developers to salvage these projects. Or not, given that the coding LLMs aren't stopping and will likely get better over time. Either way, we will need experienced people that know what to look out for / know how to instruct LLMs to output secure code and find weaknesses etc.

> We need a new KISS: keep it simple, stupid, secure.

Maybe KISSASS: "keep it simple, stupid! also secure, stupid!"

Minimization of 3rd party dependencies has always been a key for risk reduction. Now more than ever before.

Some stacks make this a lot easier than others. I regret the rules of HN effectively forbid this conversation because it has meaningful technical consequences and isn't purely about ideological flame war.

Probably nine out of ten Wordpress sites do not need active content. Why are we not rendering static copies and serving them to customers?

This is not at all easy though. Most Wordpress users are not software companies. They contract some work out to set it up, maybe some recurring maintenance but they don’t have in house development experience.

If they have a site existing today built on plugins and a theme, how are they realistically going to simplify this? How would they even know they need to without the site being hacked?

The problem is that lots of people don't want a CMS, they want a platform for development / e-commerce / bookings / whatever. Enforcing vanilla WordPress would push people towards other platforms. Now that could be a good thing, but I doubt WordPress are going to start killing their own marketshare with usage restrictions like that...

Wordpress without any plugins is kinda useless. Best to completely avoid using it, there are better options

More and more people everyday become convinced, mostly because of AI take sellers/grifters, that needing to understand your stack is unnecessary. This problem is about to get way worse.