On the near future I will have a WordPress blog, public and visible to anyone, that has a members area. This members area accesses some private data on a special database with financial data, so this kind of info should only be viewable to customers of the site.
The private site will be running inside a VPN on a business LAN and a little server, and I wonder if hosting that private part together with the public site would be a good idea.
In fact, due to WordPress vulnerabilities (it is a desired target right now) I think that if an attacker gains access to the WP site and that's inside the VPN, then he would be able to attack "from inside" and eventually he could even access to the private site and its data.
Wouldn't it be more appropiate to have the public site outside, on a VPS for example? The members area would be accessed through a secure protocol (HTPPS), and I wonder if there are some recommendations on this subject.