our marketing droids would like a blog on our domain. I checked out several, and while MovableType seems to have the least vulnerabilities, Wordpress has won the race.
I am very sceptical of installing a software tool which is exploited this often on our main servers. However the powers that be want the url of the blog to be www.domain.com/blog/ instead of blog.domain.com (which would of course allow me to run the blog on a cheap VPS somewhere).
I can always install Wordpress, run through the hardening and hope for the best. Or does anyone have an idea how I can run the blog in a subdirectory while keeping it separate, without impacting the functionality? I was playing around with proxying in a htaccess etc. without results. We are running LAMP and have a BIG IP load balancer in front, if that helps...
I am scared of attackers reaching our database through Wordpress (despite me using typical precautions like different usernames).
Any ideas?