Merge pull request #60 from lapineige/patch-1

Add a warant about wordpress risk

README.md

@@ -48,6 +48,15 @@ Supported, with LDAP and SSO.
 * Multisite only available on subdirectories.
 * As the automatic update plugin isn't working as expected, pay attention to keep your wordpress up to date from the wordpress admin panel, and not only from yunohost admin panel. For security reason, you should control that all updates are regularly applied in wordpress admin panel as well as in yunohost admin panel.
 
+**Security**
+
+Please be aware that Wordpress is known for being frequently a source of security risks (https://en.wikipedia.org/wiki/WordPress#Vulnerabilities), and also as the most popular website management system it is a target for bots and attackers.
+Some vulnerabilities might let an attacker breach into your wordpress, or even your Yunohost server (via privilege escalation).
+
+Don't forget to comply with good security principles (strong password, frequent updates, don't add unknow code in your theme/extensions…). In particular, *please keep your wordpress as up-to-date as possible*.
+
+Furthermore, you might take a look at this guide: https://codex.wordpress.org/Hardening_WordPress. You might see some benefits in the use of wordpress security plugins.
+
 ## Links
 
  * Report a bug: https://github.com/YunoHost-Apps/wordpress_ynh/issues