[stewmills]

Ok, here’s my dilemma. I have a corporate website and we are working on adding a forum. After working with bbPress for a couple of weeks I like what I see and have a good working shell, but as I get deeper I have some concerns with integrating a forum into my WordPress site versus completely stand-alone.

My question is, on a single host is there a way to have bbPress installed and totally separate from the main website. For example, current forum requests get added to my users within WordPress. While they get credentials to only have forum access and not WordPress access, it still concerns me that this is leaving open back doors for smart hackers to sneak in to my WordPress administration. I had to install some bbPress code in my functions file to stop non-administrator profiles from seeing the WordPress main menu at the top of the forum. This just seems too loose, as if hiding it with code really stops someone that knows what they are looking for from finding it.

With that, in having to add code such as this I subsequently shut down my entire site due to adding code the functions.php file that it didn’t like. Not a good situation for me. So, my second and really primary question is how I can have a forum administered in WordPress but totally separate from my main website. What I feel this gives me is 1) totally separate sites where my forum user profiles are not intermingled with my WordPress corporate site administrators and 2) a separate place where I can make site changes that I know only impact the forum and not the main site at all, so if I hose the forum temporarily it’s not as big of a crisis as if I shut down our entire web presence.

Can this be done on the same host where I have a subdomain and a separate WordPresss login for the forum as if the main website didn’t exist, or am I better off just having these creates separately under truly separate hosts and just pointing a URL on the corporate site’s menu to the stand-along forum that’s on the separate host and managed as a totally independent website?

I appreciate your suggestions.

[Robin W]

Whilst I can see some of your concerns, there are no security concerns that bbpress will let your users access your wordpress site backend – none of us would use bbpress if it had backdoors like that.

You core issue seem to stem from

I had to install some bbPress code in my functions file to stop non-administrator profiles from seeing the WordPress main menu at the top of the forum.

Please explain further? or give us the code you used.

With that, in having to add code such as this I subsequently shut down my entire site due to adding code the functions.php file that it didn’t like. Not a good situation for me.

That is a wordpress issue, and if you are not good at coding you should not be editing files ion a live site. You really need a test site

https://codex.bbpress.org/getting-started/testing-your-bbpress-installation/creating-a-test-site/

Yes you can set up a separate domain/sub-domain with wordpress and bbpress running, and just show bbpress in this site. BUT you can’t have this administered by the other wordpress site (well at least not at any level of understanding that you would have – you are not ready for multisite 🙂 )

So either you run one site or two sites. 1 site will not give you security issues if set up correctly in wordpress. 2 sites will mean lots of duplication of usernames, double updating, and more room for error.

I’d suggest you look strongly at the test site route – this will force you to learn about how a wordpress site is put together, which will allow you to do changes with confidence of more technical knowledge and no risk to live

Good luck, and do come back and let us know how you get on

[stewmills]

Thank you, Robin. I am looking into the test site option and I agree, that will give me more confidence in my learning and testing our new configurations.

[Robin W]

Great – you will learn a lot by doing so, and whilst initially it might be painful – it is worth it.

And at the end of the day, if you don’t take backups into your control, then any backups your host provider takes will be worthless if they go bust or have a major site failure. Being able to reconstruct you site anywhere is highly valuable.