After building and maintaining CMS sites for a while, here are the things I’ve learned the hard way.
Don’t run your site from the root directory.
Put the CMS in a subdirectory and forward requests there with .htaccess or whatever your server supports. It keeps the CMS files out of the way and makes it harder for someone to guess where things are. A small thing, but it helps.
Be careful about advertising what CMS you’re running.
I’m not saying hide it completely. But the “Powered by WordPress” or “Built with Drupal” badge in your footer is a signpost telling attackers exactly what to exploit. If you want to credit the software, do it in the source code or somewhere that doesn’t help a script kiddie.
Stick with stable releases.
The temptation to run the latest beta is understandable. New features are exciting. But a CMS that’s still in beta means you’re doing unpaid QA for the developers. Stable versions have had their obvious problems sorted out. When you do update, back everything up first.
A CMS doesn’t mean you don’t need to know how to code.
It means you need to know how to code in a different way. You still need to understand HTML, CSS, and whatever templating language the CMS uses. When a plugin breaks or a theme doesn’t render correctly, you’ll need to dig into the code to fix it. A CMS reduces the amount of boilerplate, not the need to understand what’s happening.
Fantastico is convenient but flawed.
Most shared hosting providers offer Fantastico for one-click installs of popular applications. It’s quick, but it often installs outdated versions, forces its own database naming conventions, and doesn’t handle updates properly. It’s fine for a quick test, but for anything you actually care about, install manually. You’ll have more control and you’ll know exactly what’s on your server.