Comment by technion
3 hours ago
In nearly every org I've been in or contracted to, the public landing page of the company gets a special place outside of any ops of general technical team, and is instead the work of a marketing group or a "creative" outsourcer who will default to Wordpress on PHP.
This rings extremely true. The good part about it is, unless there's some kind of exceptional factor (e.g. the app.companyname . com cookie using a cookie scoped unwisely to companyname . com), they can go right ahead and do that and while they might get the corpsite homepage pwned and redirected to penis-pill scam sites or something, any truly dangerous actor who gets a foothold there can't do jack shit in terms of actually compromising your valuable data, getting source code, stealing app sessions, etc because that server is not just outside the VPC, it's in a completely different cloud account somewhere far away.
Seems like most main company sites at places I've worked. If you are lucky, that WP instance is a fully managed service where they proactively deal with keeping it on the latest PHP, WordPress, and plug-in versions.
I’ve been to a few places like this and managed to get rid of the Wordpress infestation.
This is how it began and should stay, when IT teams started to get involved in this they ran heavy overhead and aren't clued in on creative requirements. Stick to keeping emails and erp servers up.