I get your points, but at least with custom code you have security by obscurity. Using out of the box stuff puts you in a higher level of security risk because anyone can access the code and find bugs and how to exploit them. At least with custom code, it&#x27;ll take some time for them to find something and attack you.<p>I mean for crying out loud, just installing Wordpress invites people trying to get in using automated tools. You can deploy a wordpress blog at it&#x27;s default state, and wake up 3 days later to it being spammed.