As someone who has just spent the last two weeks attempting to secure and standardize a WordPress install, my sincerest condolences to Wired's system administrators.<p>WordPress has achieved the complexity promised by Zawinski's Law, and is a true nightmare to attempt to secure. Not only do you have software which writes its own full URLs (including the scheme), you have software which checks and optionally triggers a built-in cron with every request, one PHP file which rules them all, an average of four cookies for every visit (which messes with some caching attempts), a mish-mash of JS and CSS files, static assets spread throughout the wordpress base, every plugin, and every theme, executable PHP in the DB...<p>It can even install its own plugins, if you give it the credentials to FTP to the server which hosts it.<p>I'm glad this project is nearing its completion. The promises made by Wordpress to content creators is backed by the nightmares of system administrators.<p>Zawinski's Law: “Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.”<p>EDIT:<p>Dear WordPress Sysadmins:<p>You still have some work to do in securing your site. For example, I can tell just from your headers that you're running on Apache 2.4.6, on PHP 5.6.6, and using Varnish 4 as your caching mechanism from your somewhat verbose headers.<p>Good luck!