Comment by trollbridge

It's not. I maintain some WP sites, including one that is so custom that it can't be run on a service like WPEngine. I just assume it will be hacked on a regular basis.

Large swaths of the filesystem are chattr +i'd, non-writeable by the user PHP runs as. I have capabilities and network rules applied so that that context can't communicate outbound on the network. I have a WAF that restricts outbound traffic (normal users never download something as big as even 1 megabyte). I have a set of firewall rules to tarpit any automated scans that come near the site.

Nowadays, I run an AI agent continuously that scans the VM everything is hidden in for any signs of an intrusion, plus the host that contains the VM as well. I make sure that agent is sandboxed as well. (This only costs a few dollars a day in tokens which I bill to the customer.)

After this next world-wide intrusion, I may finally be able to convince the client they need to get off the WordPress e-commerce site that they got a teenage girl to do for free a decade ago.