thats because the defult config is like that the other link i gave u gives you some advice on how to secure it more but i havnt had 1 hack attept or anything on my server which runs it , and none of my friends have had a problem with security if u set up apache or iss yourself i bet u it will be as insecure as easy php is anyway